Vidar Stealer Browser Process Enumeration via CreateToolhelp32Snapshot
Detects Vidar Stealer attempting to enumerate browser processes (chrome.exe, msedge.exe, brave.exe) using the CreateToolhelp32Snapshot API call, often followed by Process32First/Next, to target memory for data exfiltration. The rule looks for processes initiating these API calls that are not common system or legitimate debugging tools.
Microsoft Sentinel (KQL)
