Remote DLL injection into browser processes via VirtualAllocEx/WriteProcessMemory/CreateRemoteThread + LoadLibraryW
Detects an infostealer-style remote injection chain where a non-browser process allocates memory, writes a DLL path, and creates a remote thread pointing at kernel32!LoadLibraryW inside chrome.exe, msedge.exe, brave.exe, or firefox.exe. This suspend-inject-resume pattern is used by WEES Stealer to load its payload DLL into a browser process before intercepting App-Bound key material.
Microsoft Sentinel (KQL)
