Unsigned or Masquerading Chrome Process Invoking CNG NCrypt Against MS_PLATFORM_CRYPTO_PROVIDER
Detects a non-browser process (unsigned, or not matching the legitimate Chrome/Edge install path and signature) invoking Windows CNG NCrypt APIs against the TPM-backed platform crypto provider, consistent with an attacker mimicking Chrome's passkey identity/UV key signing flow to forge authentication (Pass-ta-key). Excludes correctly signed Chrome and Edge processes running from their standard install locations.
Microsoft Sentinel (KQL)
