ChocoShell Unusual Process Access to Token Broker Cache .tbres Files (Fileless PowerShell Correlation)

Duo Tech@duotech

•updated Aug 6, 2026•1•0•3

Detects non-standard processes, particularly fileless PowerShell, accessing Windows Token Broker cache (.tbres) files, a technique associated with ChocoShell credential/token theft.