SIGNATURE_BASE_HKTL_NET_Edge_Saved_Passwords_Dumper_May26

rule SIGNATURE_BASE_HKTL_NET_Edge_Saved_Passwords_Dumper_May26
{
	meta:
		description = "Detects an .NET based tool used to dump saved passwords from Microsoft Edge browser processes"
		author = "Florian Roth"
		id = "9d09b27e-16a4-5396-af53-2a2c672bc985"
		date = "2026-05-05"
		modified = "2026-05-15"
		reference = "https://github.com/L1v1ng0ffTh3L4N/Proof-of-Concepts/tree/main/EdgeSavedPasswordsDumper"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/hktl_edge_pwd_dumper_may25.yar#L1-L17"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "b0bfcb6fd5968ed8b7b025dc6fb0e2874eb49e00ffc4827e3cd334a8c48d2f12"
		score = 80
		quality = 85
		tags = ""

	strings:
		$x1 = "SELECT ProcessId, Name, ParentProcessId FROM Win32_Process WHERE Name='msedge.exe'" wide
		$x2 = "Scanning process PID: " wide
		$s1 = "NSC\\t1_" wide
		$s2 = "\\*\\(\\)_\\-\\+=\\{\\}\\[\\]:;<>\\?/~\\s]{6,40})\\x20\\x00" wide

	condition:
		2 of them
}