Drun Chrome App-Bound Encryption Bypass via vt-windows-event-stream.exe
Detects the Drun/Chromelevator infostealer bypassing Chrome App-Bound Encryption (introduced in Chrome 127) by spawning vt-windows-event-stream.exe to call Chrome's Elevation Service via COM and decrypt app_bound_encrypted_key from the Local State file. The rule looks for process creation of 'vt-windows-event-stream.exe', registry queries by 'drun.exe' or 'vt-windows-event-stream.exe' related to Chrome installation paths, and file access to Chrome's 'Local State' file by these processes.
Microsoft Sentinel (KQL)
