Blind Eagle JC-46 SYSTEM Escalation via Winlogon Token Impersonation for Chrome ABE Bypass
Detects the JC-46 AsyncRAT technique chain where the malware opens winlogon.exe's process token, duplicates it into an impersonation token, calls ImpersonateLoggedOnUser, enables SE_DEBUG_NAME via AdjustTokenPrivileges to reach SYSTEM context, then uses CNG (NCryptOpenStorageProvider/NCryptOpenKey/NCryptDecrypt) and BCrypt AES-GCM (BCryptOpenAlgorithmProvider) APIs to unwrap Chromium v96+ App-Bound Encryption keys.
Cortex XDR
