Chrome/Edge IElevator App-Bound Encryption Key Theft via Automated Browser Launch

Ibrahim Saud@tektrix

•updated Jul 3, 2026•2•0•7

This rule monitors for a suspicious execution pattern where a browser (Chrome or Edge) is launched with specific command-line flags ('--no-first-run', '--disable-gpu', 'about:blank') by a non-standard parent process, followed shortly by the loading of the 'elevation_service.exe' from 'services.exe' and the loading of 'DPAPI.dll' by the browser process. This sequence is often associated with automated browser credential dumping activities, where attackers attempt to bypass UI requirements or programmatically extract secrets from the browser's credential storage.