TencShell - Chrome / Edge Artifact Backup (T1005)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•3

Detects the browser data collection routines matching Opcodes 0x23 (Chrome) and 0x2B (Edge) creating database snapshots, specifically looking for file creations with names matching 'chrome_backup' or 'edge_backup' initiated by 'setup.exe'.