Disable Application Bound Encryption for Chrome and Edge

Rule Info

Name
Disable Application Bound Encryption for Chrome and Edge
Author
MalGamy
Description
Detects disabling of Application Bound Encryption for Google Chrome and Microsoft Edge by setting registry keys to 0.
Reference
https://redcanary.com/blog/threat-intelligence/google-chrome-app-bound-encryption
Date
2024-11-14 00:00:00
Modified
None
Id
d335273f-0e92-4640-aa43-5c611f1cf268
Tags
attack.defense-evasion attack.t1562.001
Type
Nextron Sigma feed only (private)

Rule History

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022