T1059.001: PowerShell Carves DLL from Chrome Cache_Data via INDLL/OUTDLL Markers

Tim Peck@timpeck

•updated today•0•0•4

Detects the execution of rundll32.exe loading a DLL directly from common browser cache directories (Firefox, Chrome, or Edge), which is indicative of the SensePost cache-smuggling proof-of-concept technique.