Non-browser process accessing Chrome Local State after PowerShell staging

ills3c Intel&Coffee@Ills3C

•updated yesterday•3•0•5

Detects access to Chrome or Chromium-based browser Local State files (which contain encrypted keys) by a non-browser process that correlates temporally with a PowerShell process exhibiting ClickFix-style staging characteristics (hidden window, bypass execution policy, and containing a URL).