All Detections

Rapuncel DLL injection into Chrome/Edge to abuse Elevation Service

avatar
Ibrahim Saud@tektrix
updated 20 days ago000

Detects DLL injection into browser processes (chrome.exe or msedge.exe) followed by the invocation of the browser's Elevation Service 'DecryptData' function, a behavior characteristic of the Rapuncel credential stealer attempting to bypass app-bound encryption.

YARA-L