Rapuncel Chrome App-Bound Encryption Bypass via DLL Injection

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•6

Detects activity related to potential browser credential theft, specifically targeting Chrome and Microsoft Edge. The rule monitors for the loading of a specific suspicious file, the presence of browser-specific decryption artifacts such as 'browser_decryption.log' or 'ProtectR3.dll', and process command-line arguments containing keywords like 'DecryptData' or 'Elevation Service' associated with browser credential extraction.