Browser bookmark files accessed by a rare non-browser process

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent Requires: eXtended Threat Hunting (XTH)
Detection Modules
ATT&CK Tactic	Discovery (TA0007)
ATT&CK Technique	Browser Information Discovery (T1217)
Severity	Informational

Browser bookmark files accessed by a rare non-browser process.

Accessing these files is done by attackers to collect information about the endpoint.

Investigate the actor process to determine if it was used for legitimate purposes or malicious activity.