DPAPI Abuse - Non-Browser Process Decrypting Chrome/Edge Credentials

F S@Fsdr

•updated Mar 31, 2026•20•0•183

This rule detects suspicious activity where a non-browser process attempts to decrypt credentials stored by Google Chrome or Microsoft Edge using DPAPI (Data Protection API). This could indicate an adversary attempting to steal stored browser credentials.