Drun Chrome App-Bound Encryption Bypass via elevation_service.exe COM
Detects the 'drun.exe' loader attempting to bypass Chrome's credential protection mechanisms. This is identified by 'drun.exe' invoking 'elevation_service.exe' (a Chrome component) or querying specific Chrome-related registry keys associated with App-Bound Encryption.
Microsoft Sentinel (KQL)
