Detects ChromElevator

Family: ChromElevator

ChromElevator is an open-source post-exploitation tool for stealing user data from Chromium browsers.

Detect binaries embedding considerable number of MFA browser extension IDs.

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detected Nirsoft tools

Free utilities often used by attackers which can steal passwords, product keys, etc.

Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Detects Reflective DLL injection artifacts

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables containing bas64 encoded gzip files

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

NirSoft WebBrowserPassView

Password recovery tool for various web browsers