StealC APC Injection into Suspended Chrome/Edge Process via C:\ProgramData IPC File
Detects StealC malware injecting into suspended chrome.exe or msedge.exe processes via APC injection to bypass Chromium App-Bound Encryption. The detection is correlated with the creation or modification of an IPC output file in C:\ProgramData\ with a specific naming convention (<HWID>.txt).
Microsoft Sentinel (KQL)
