Detects a DLL used to decrypt App-Bound Encrypted (ABE) cookies, passwords and payment methods from Chromium-based brows

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging specific decryption DLLs to exfiltrate sensitive App-Bound Encrypted data, such as cookies and credentials, from Chromium-based browsers—a technique notably employed by the Katz stealer. Proactive hunting for this behavior in Azure Sentinel is critical because it enables early detection of memory-resident credential theft that may bypass traditional network-based controls before significant data loss occurs.

YARA Rule

rule MAL_DLL_Chrome_App_Bound_Encryption_Decryption_May25 {
   meta:
      description = "Detects a DLL used to decrypt App-Bound Encrypted (ABE) cookies, passwords and payment methods from Chromium-based browsers. Seen being used by Katz stealer"
      author = "MAlGamy"
      date = "2025-05-19"
      reference = "Internal Research"
      hash = "6dc8e99da68b703e86fa90a8794add87614f254f804a8d5d65927e0676107a9d"
      score = 80
      id = "ee1e2584-7104-506f-93a9-89e97cf39a93"
   strings:
      $s1 = "Failed to set proxy blanket." ascii
      $s2 = "Decryption failed. Last error:" ascii
      $s3 = "\\Google\\Chrome\\User Data\\Local State" ascii

      $op1 = {48 39 F3 74 ?? 4C 89 E2 48 89 E9 E8 ?? ?? ?? ?? 48 89 C1 48 8B 00 B2 ?? 48 8B 40 ?? 48 C7 44 01 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 13 48 89 C1 E8 ?? ?? ?? ?? 48 FF C3 EB ?? 48 8D 54 24 ?? 48 89 F9 E8 ?? ?? ?? ?? 48 89 E9 E8 ?? ?? ?? ?? 48 89 F8 48 81 C4}
   condition:
      uint16(0) == 0x5a4d
      and filesize < 2MB
      and $op1 and 1 of ($s*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects a DLL used to decrypt App-Bound Encrypted (ABE) cookies…” rule, along with recommended filters and exclusions:

• Corporate Password Manager Synchronization

  • Scenario: Enterprise-wide deployment of tools like LastPass, 1Password, or Dashlane. These applications frequently inject DLLs into Chromium-based browsers (Chrome, Edge, Brave) to decrypt stored credentials for synchronization or autofill features. This behavior mimics the ABE decryption logic targeted by the rule.
  • Filter/Exclusion: Create an exclusion based on the specific process name of the password manager (e.g., LastPass.exe, 1PasswordService.exe) and filter out events where the parent process is a known enterprise application rather than a generic browser instance (chrome.exe or msedge.exe).

• Scheduled Browser Profile Backup Jobs

  • Scenario: IT administrators often schedule nightly tasks using Windows Task Scheduler to back up user profile data, including browser cookies and payment tokens. Scripts utilizing PowerShell or custom backup agents (e.g., Veeam, Acronis) may invoke the ABE decryption DLL to read encrypted data before archiving it.
  • Filter/Exclusion: Exclude events where the process command line contains specific keywords like backup, sync, or archive. Additionally, filter by time-of-day (e.g., exclude runs between 01:00 and 05:00) if these jobs are strictly off-hours.

• Endpoint Detection and Response (EDR) Scanning

  • Scenario: Security agents such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black perform real-time scanning of browser artifacts. When the EDR agent scans active Chromium processes to detect memory injections, it may trigger the