Vidar ABE Bypass: Suspicious Chrome Spawn and Credential File Access
Detects Vidar Stealer's technique of bypassing Chrome's Application-Bound Encryption by spawning a suspended Chrome instance with specific command-line flags for APC-based CryptUnprotectMemory injection, combined with accessing Chrome credential files (Login Data, Cookies, Local State) for cookie and password theft. This rule correlates process creation events of Chrome with suspicious command-line arguments and file access events to Chrome's credential stores by the same initiating process within a short time frame.
Microsoft Sentinel (KQL)
