Credentials from Password Stores: Credentials from Web Browsers

Malicious Access or copy of Web Browser Credential store.

Command and Scripting Interpreter: PowerShell

Using powershell.exe command.

Drops file in Drivers directory