Vidar Stealer APC Injection into Suspended Chrome Process via QueueUserAPC
Detects potential process injection into Google Chrome processes using Asynchronous Procedure Calls (APC) or remote thread creation. This rule specifically looks for Chrome processes launched with specific command-line arguments (indicating a potentially controlled or sandboxed environment) that then have remote API calls like QueueUserApcRemoteApiCall, CreateRemoteThreadApiCall, or NtQueueApcThreadApiCall targeting them, originating from a different process. The AdditionalFields check for 'CryptUnprotectMemory', 'NtTestAlert', or 'NtQueueApcThreadEx2' further refines the detection of suspicious APC-related activities.
Microsoft Sentinel (KQL)
