Rapuncel DLL injection into Chrome/Edge to bypass app-bound encryption

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•6

Detects the loading of a known malicious 136KB browser injection helper DLL (SHA256: 75018b06c7105a1dca391805d17b402aed35ebd515b92d461236eafbd606cb40) into Google Chrome or Microsoft Edge processes. The rule further correlates this activity with command line arguments indicative of abusing the browser's elevation service, which is a technique often used for process injection or local privilege escalation.