Vidar APC Injection of CryptUnprotectMemory into Browser Process

Ibrahim Saud@tektrix

•updated Jun 24, 2026•1•0•6

Detects attempts to inject code into browser processes (Chrome, Edge, Brave) using various API calls associated with process injection techniques. This rule specifically looks for calls like QueueUserApcRemoteApiCall, NtQueueApcThreadApiCall, CreateRemoteThreadApiCall, and WriteProcessMemoryApiCall, especially when combined with specific functions like CryptUnprotectMemory or NtQueueApcThread, within a short time frame.