Detects an .NET based tool used to dump saved passwords from Microsoft Edge browser processes

Hunt Hypothesis

This rule detects adversaries leveraging .NET-based tools to extract stored credentials directly from active Microsoft Edge browser processes, a technique often employed during post-compromise reconnaissance or lateral movement phases. SOC teams should proactively hunt for this behavior in Azure Sentinel because credential theft from browsers represents a high-impact attack vector that can lead to immediate identity compromise and unauthorized access to sensitive data if not identified early.

YARA Rule

rule HKTL_NET_Edge_Saved_Passwords_Dumper_May26 {
   meta:
      description = "Detects an .NET based tool used to dump saved passwords from Microsoft Edge browser processes"
      author = "Florian Roth"
      reference = "https://github.com/L1v1ng0ffTh3L4N/Proof-of-Concepts/tree/main/EdgeSavedPasswordsDumper"
      date = "2026-05-05"
      score = 80
      id = "9d09b27e-16a4-5396-af53-2a2c672bc985"
   strings:
      $x1 = "SELECT ProcessId, Name, ParentProcessId FROM Win32_Process WHERE Name='msedge.exe'" wide
      $x2 = "Scanning process PID: " wide

      $s1 = "NSC\\t1_" wide
      $s2 = "\\*\\(\\)_\\-\\+=\\{\\}\\[\\]:;<>\\?/~\\s]{6,40})\\x20\\x00" wide
   condition:
      2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• https://github.com/L1v1ng0ffTh3L4N/Proof-of-Concepts/tree/main/EdgeSavedPasswordsDumper
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule detecting .NET-based password dumping of Microsoft Edge processes, along with suggested filters or exclusions:

• Scheduled Credential Backup by IT Admins

  • Scenario: An automated nightly job runs a custom PowerShell script (using Microsoft.PowerShell.ConsoleHost.exe or a dedicated .NET wrapper) to extract user credentials from Edge for compliance auditing. The script targets the msedge.exe process to export saved passwords to a secure CSV file on a network share.
  • Filter/Exclusion: Exclude alerts where the parent process is powershell.exe running under the context of a specific “Backup Service Account” (e.g., DOMAIN\svc-edge-backup) and the execution path matches the known backup script location (e.g., C:\Scripts\EdgePasswordExport.ps1).

• Endpoint Security Agent Routine Scans

  • Scenario: A third-party endpoint detection and response (EDR) agent, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, performs a routine integrity check. The agent utilizes an internal .NET module to query the Edge process memory to verify stored credential hashes against a baseline database.
  • Filter/Exclusion: Create an exclusion based on the specific EDR vendor’s known .NET tool name (e.g., C:\Program Files\CrowdStrike\FalconSensor\Tools\EdgeAudit.exe) and filter out events where the user context is the local system account (NT AUTHORITY\SYSTEM).

• User-Initiated Password Migration via Enterprise Tools

  • Scenario: During a corporate migration project, IT staff use a commercial tool like “NirSoft WebList” or a custom .NET utility to migrate saved passwords from legacy Edge profiles to new user accounts. This involves launching the tool which interacts directly with the running msedge.exe process.