Correlated Multi-Technique Browser Credential Theft (SYSTEM Impersonation, VSS, CDP Debug, Scheduled-Task Relaunch)

Duo Tech@duotech

•updated Aug 6, 2026•5•0•6

Detects correlated activity within a 15-minute window combining two or more browser credential-theft indicators: CDP remote-debugging launch, scheduled task with TASK_LOGON_INTERACTIVE_TOKEN, SYSTEM token impersonation, and VSS shadow copy creation.