ChocoShell cloud token and browser credential theft via SYSTEM impersonation, VSS snapshot, CDP debugging, Firefox cookie copy, and Token Broker cache access
Detects multiple stages of the ChocoShell credential and token theft framework, including SYSTEM token impersonation for DPAPI key access, VSS shadow copy abuse to extract browser databases, malicious use of browser remote debugging ports (CDP) for cookie exfiltration, and unauthorized access to browser profile files or Token Broker cache (.tbres) files.
Microsoft Sentinel (KQL)
