# Defending Against Modern Infostealers: Actionable Defense Guide (2025-2026)

## Executive Summary

Infostealers stole **1.8 billion credentials** from **5.8 million devices** in H1 2025 alone -- an 800% increase from prior years. Stolen credentials now drive **86% of all breaches** and are the #2 initial access vector (22% of confirmed breaches). 54% of ransomware victims had prior credential exposure in stealer logs. This guide covers what actually works, what doesn't, and where defenders should focus.

---

## 1. What Actually Stops Modern Stealers vs. What Doesn't

### What Works

| Defense | Why It Works | Effectiveness |
|---------|-------------|---------------|
| **DBSC (Device Bound Session Credentials)** | Binds session cookies to TPM-backed keys; stolen cookies are useless on other devices | High -- directly counters the #1 stealer target |
| **Passkeys / FIDO2** | Eliminates passwords entirely; nothing to steal | Very High -- complete removal of attack surface |
| **Short-lived session tokens (< 1hr TTL)** | Reduces window for stolen token replay | Medium-High -- limits damage even if theft occurs |
| **Application allowlisting + Smart App Control** | Blocks unknown/unsigned binaries before execution | High -- prevents initial execution |
| **ASR rules in Block mode** | Blocks LSASS access, Office child processes, script abuse | High -- direct mitigation of common techniques |
| **Credential Guard (VBS)** | Isolates NTLM hashes and Kerberos TGTs in secure enclave | High for OS creds -- but stealers target browsers instead |
| **HVCI** | Prevents unsigned kernel code execution; forces data-only attacks | High -- eliminates entire classes of kernel exploits |
| **CET Shadow Stack** | Hardware-enforced return address integrity; kills ROP chains | High for exploit-based delivery; less relevant to social engineering delivery |
| **Browser isolation (RBI)** | Credentials never touch endpoint; phishing pages can't capture input | Very High for targeted scenarios |
| **Zero Trust + microsegmentation** | Limits lateral movement even with valid stolen creds | High -- 60% breach reduction (Gartner 2025) |

### What Doesn't Work (Alone)

| Defense | Why It Falls Short |
|---------|-------------------|
| **Signature-based AV only** | Stealers repack/morph constantly; 66% evade EDR |
| **MFA without device binding** | Session cookies bypass MFA entirely via anti-detect browsers |
| **Credential Guard alone** | Protects OS creds but not browser-stored passwords, cookies, tokens |
| **Network perimeter firewalls** | Stealers exfiltrate over HTTPS to legitimate-looking C2 |
| **User training alone** | Social engineering constantly evolves; one click is all it takes |
| **App-Bound Encryption (Chrome, legacy)** | Already bypassed by multiple stealer families; being replaced by DBSC |

---

## 2. Detection Rules and Signatures

### 2.1 YARA Rules

**Elastic Security provides production-ready YARA rules:**
- `Windows_Infostealer_Generic.yar` -- generic infostealer behavioral patterns
- `Windows_Trojan_Lumma.yar` -- Lumma-specific detection
- Repository: `github.com/elastic/protections-artifacts/tree/main/yara/rules/`

**VMRay** maintains updated YARA rules and configuration extractors for Lumma, Vidar 2.0, StealC, and emerging families, with monthly detection highlight releases.

**Key YARA detection patterns for infostealers:**
```yara
rule Infostealer_Browser_DB_Access {
    meta:
        description = "Detects binary accessing browser credential databases"
    strings:
        $s1 = "Login Data" ascii wide
        $s2 = "logins.json" ascii wide
        $s3 = "key4.db" ascii wide
        $s4 = "Cookies" ascii wide
        $s5 = "Web Data" ascii wide
        $s6 = "Local State" ascii wide
        $chrome_path = "\\Google\\Chrome\\User Data\\" ascii wide
        $firefox_path = "\\Mozilla\\Firefox\\Profiles\\" ascii wide
        $edge_path = "\\Microsoft\\Edge\\User Data\\" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        3 of ($s*) and
        1 of ($chrome_path, $firefox_path, $edge_path)
}

rule Infostealer_Crypto_Wallet_Theft {
    meta:
        description = "Detects binary targeting cryptocurrency wallets"
    strings:
        $w1 = "wallet.dat" ascii wide
        $w2 = "exodus" ascii wide nocase
        $w3 = "metamask" ascii wide nocase
        $w4 = "phantom" ascii wide nocase
        $w5 = "electrum" ascii wide nocase
        $w6 = "\\Ethereum\\keystore" ascii wide
    condition:
        uint16(0) == 0x5A4D and 3 of them
}
```

### 2.2 Sigma Rules

**LSASS Credential Dumping:**
```yaml
title: Suspicious LSASS Process Access
id: a2f29a02-0bf0-4730-b2d2-d8b38e0f5e48
status: stable
logsource:
    category: process_access
    product: windows
detection:
    selection:
        TargetImage|endswith: '\lsass.exe'
        GrantedAccess|contains:
            - '0x1010'
            - '0x1410'
            - '0x1038'
            - '0x1438'
            - '0x143a'
    filter_system:
        SourceImage|endswith:
            - '\wmiprvse.exe'
            - '\taskmgr.exe'
            - '\procexp64.exe'
            - '\MsMpEng.exe'
    condition: selection and not filter_system
level: high
```

**Browser Credential Store Access by Non-Browser Process:**
```yaml
title: Non-Browser Process Accessing Browser Credential Store
logsource:
    category: file_access
    product: windows
detection:
    selection:
        TargetFilename|contains:
            - '\Google\Chrome\User Data\Default\Login Data'
            - '\Google\Chrome\User Data\Default\Cookies'
            - '\Google\Chrome\User Data\Local State'
            - '\Microsoft\Edge\User Data\Default\Login Data'
            - '\Mozilla\Firefox\Profiles\'
    filter_browsers:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
            - '\opera.exe'
    condition: selection and not filter_browsers
level: high
```

**HVCI Tampering Detection (from SigmaHQ):**
```yaml
title: HVCI Registry Tampering via Command Line
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - 'HypervisorEnforcedCodeIntegrity'
            - 'Enabled'
            - '0'
    condition: selection
level: critical
```

### 2.3 KQL / Sentinel Queries

**Suspicious browser credential file access:**
```kql
DeviceFileEvents
| where FileName in ("Login Data", "Cookies", "Web Data", "Local State", "key4.db", "logins.json")
| where InitiatingProcessFileName !in ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe", "update.exe")
| where ActionType == "FileRead" or ActionType == "FileModified"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath
| sort by Timestamp desc
```

**LSASS access from unusual processes:**
```kql
DeviceEvents
| where ActionType == "OpenProcessApiCall"
| where FileName == "lsass.exe"
| where InitiatingProcessFileName !in ("MsMpEng.exe", "csrss.exe", "wininit.exe", "svchost.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
```

**Chrome remote debugging abuse:**
```kql
DeviceProcessEvents
| where ProcessCommandLine has "--remote-debugging-port"
    or ProcessCommandLine has "--remote-allow-origins"
| where InitiatingProcessFileName != "chrome.exe"
| project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessFileName
```

**Suspicious data exfiltration (stealer C2 pattern):**
```kql
DeviceNetworkEvents
| where RemotePort in (443, 80)
| where InitiatingProcessFileName !in ("chrome.exe", "msedge.exe", "firefox.exe", "svchost.exe", "OneDrive.exe")
| where RemoteUrl !has "microsoft.com" and RemoteUrl !has "windows.com"
| summarize TotalBytes=sum(SentBytes), ConnectionCount=count() by InitiatingProcessFileName, RemoteUrl, bin(Timestamp, 5m)
| where TotalBytes > 1000000 or ConnectionCount > 50
```

---

## 3. Behavioral Indicators That Are Hard for Stealers to Avoid

These are **unavoidable** actions that any infostealer must perform, making them high-fidelity detection opportunities:

### 3.1 File Access (Must Touch These Files)

| Target | File Paths | Detection Method |
|--------|-----------|-----------------|
| Chrome passwords | `%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data` | Sysmon Event ID 11, file access audit |
| Chrome cookies | `%LOCALAPPDATA%\Google\Chrome\User Data\Default\Cookies` | Same |
| Chrome local state (encryption key) | `%LOCALAPPDATA%\Google\Chrome\User Data\Local State` | Same |
| Firefox credentials | `%APPDATA%\Mozilla\Firefox\Profiles\*\logins.json`, `key4.db` | Same |
| Edge passwords | `%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data` | Same |
| Crypto wallets | Various `wallet.dat`, extension data | FileSystemWatcher / Sysmon |

**Key principle:** Any process other than the browser itself reading these files is suspicious. This is a high-signal, low-noise detection.

### 3.2 API Calls (Must Make These Calls)

| Action | API/Syscall | Detection |
|--------|-------------|-----------|
| LSASS memory read | `OpenProcess` with `PROCESS_VM_READ` on lsass.exe | Sysmon EventCode 10 with GrantedAccess 0x1010/0x1410 |
| Chrome DPAPI decryption | `CryptUnprotectData` | ETW tracing on DPAPI provider |
| SQLite database copy (bypass file lock) | `CreateFile` + `DuplicateHandle` or `Volume Shadow Copy` | Handle duplication to browser DB files |
| Headless browser spawn | Chrome with `--headless`, `--remote-debugging-port` | Process creation monitoring |
| IElevator COM access | Non-browser process calling `IElevator` interface | COM object access monitoring |

### 3.3 Process Behavior Patterns

- **Rapid sequential access** to multiple browser profiles/credential stores within seconds
- **Short-lived process** that accesses credential stores then makes outbound HTTPS connection
- **Non-interactive process** spawned from temp/download directory accessing credential files
- **Process injection** into browser process from non-browser parent
- **Clipboard monitoring** (keylogger component) -- SetClipboardViewer / AddClipboardFormatListener

---

## 4. OS-Level Mitigations

### 4.1 Intel CET (Control-flow Enforcement Technology)

**What it does:** Hardware shadow stack prevents ROP/JOP exploit chains. The CPU maintains a separate shadow stack of return addresses that attackers cannot modify.

**Impact on stealers:** Primarily affects exploit-based delivery (drive-by downloads, document exploits). Less effective against social-engineering delivery (user runs malicious exe). When combined with HVCI, forces attackers into data-only attack patterns.

**Deployment:** Requires Intel 11th gen+ or AMD Zen 3+ CPU. Windows 11 22H2+ supports kernel-mode CET. Enable via Windows Security > Device Security > Core Isolation.

### 4.2 HVCI (Hypervisor-Protected Code Integrity)

**What it does:** Uses VBS hypervisor to prevent unsigned code execution in kernel mode. Eliminates RWX memory in kernel space.

**Impact on stealers:** Blocks vulnerable driver abuse (BYOVD) unless driver is signed. Prevents kernel rootkits that would disable EDR. Forces attackers to user-mode only operations. Enabled by default in Windows 11 22H2+ and Server 2025.

**Critical:** Monitor for attempts to disable HVCI via registry tampering (`HypervisorEnforcedCodeIntegrity` set to 0).

### 4.3 ACG (Arbitrary Code Guard)

**What it does:** Prevents dynamic code generation and modification in protected processes. Enforces W^X (write XOR execute) in user mode.

**Impact on stealers:** Prevents reflective DLL injection and shellcode execution in ACG-protected processes. Browsers (Edge, Chrome) use ACG in renderer processes.

### 4.4 CFG (Control Flow Guard)

**What it does:** Validates indirect call targets against a bitmap of valid targets at compile time.

**Impact on stealers:** Prevents hijacking of function pointers in protected binaries. Combined with CET, provides comprehensive control-flow integrity.

### 4.5 Credential Guard (VBS-based LSASS isolation)

**What it does:** Moves NTLM hashes and Kerberos TGTs into a VBS-protected enclave. LSASS runs in isolated mode.

**Impact on stealers:** Completely defeats Mimikatz-style LSASS dumping for domain credentials. **Critical limitation:** Does NOT protect browser-stored credentials, cookies, or session tokens -- which is what modern stealers primarily target. Must be paired with browser-level defenses.

**Deployment:** Enabled by default in Windows 11 Enterprise 22H2+. Check with `msinfo32` > Credential Guard status.

### 4.6 Smart App Control (SAC)

**What it does:** Cloud-backed reputation check blocks unknown/unsigned binaries before execution. Uses AI behavioral analysis for borderline cases.

**Impact on stealers:** Strong first-line defense against stealer execution. Blocks binaries not seen by Microsoft's telemetry. As of Windows 11 24H2/25H2, can be toggled without OS reinstall.

**Limitations:** No per-app exception mechanism. Sophisticated stealers may use signed binaries, living-off-the-land techniques, or supply chain compromise to bypass.

---

## 5. Browser-Level Mitigations

### 5.1 DBSC (Device Bound Session Credentials) -- THE KEY DEFENSE

**Status:** Chrome open beta (July 2025+). Second origin trial October 2025 - February 2026. W3C First Public Working Draft published 2025.

**How it works:**
1. Browser generates TPM-backed keypair during login
2. Server issues short-lived session cookie
3. On cookie expiry, browser proves private key possession before refresh
4. Stolen cookie is useless on another device (no TPM private key)

**Enterprise deployment:** Available for Google Workspace admins. Enable via Admin Console > Security > Session Binding.

**Limitations:**
- Currently Chrome on Windows only
- Requires TPM 2.0
- Does not prevent on-device session abuse while attacker is resident
- Requires server-side adoption

### 5.2 App-Bound Encryption (Chrome, legacy)

Chrome 127+ encrypted cookies with a key bound to the app identity. **Already bypassed** by multiple stealer families (Lumma, Vidar, MeduzaStealer). Being replaced by DBSC. Not a reliable defense in 2025+.

### 5.3 Remote Debugging Lockdown

**Chrome M144+:** Shows user permission dialog when any process requests remote debugging session. No longer silently allows `--remote-debugging-port`.

**Enterprise policy:** Set `RemoteDebuggingAllowed` to `false` in Chrome enterprise policy. Monitor for `--remote-debugging-port` in process command lines.

### 5.4 Enterprise Browser Isolation (RBI)

**How it works:** Web content executes on remote server; only rendered pixels reach endpoint. Credentials autofilled from vault never exist on endpoint.

**Best for:**
- High-value targets (executives, finance, IT admins)
- Accessing sensitive SaaS applications
- Unknown/risky websites

**Leading solutions:** Zscaler, Cisco Umbrella RBI, Keeper (PAM-integrated), Forcepoint RBI.

---

## 6. Enterprise Controls That Work

### Priority 1: Immediate Actions (Week 1-2)

1. **Enable ASR rules in Block mode:**
   - `Block credential stealing from lsass.exe` (now default Block in Defender)
   - `Block executable content from email client and webmail`
   - `Block Office applications from creating child processes`
   - `Block untrusted and unsigned processes that run from USB`

2. **Enable LSASS PPL (Protected Process Light):**
   ```
   Registry: HKLM\SYSTEM\CurrentControlSet\Control\Lsa
   Value: RunAsPPL = 1 (DWORD)
   ```

3. **Deploy Sysmon with credential-theft-focused config:**
   - Event ID 10: Process Access (filter for lsass.exe targets)
   - Event ID 11: File Create (browser credential paths)
   - Event ID 1: Process Create (command line logging)

4. **Shorten session cookie TTL** to 1 hour for sensitive applications

5. **Block Chrome remote debugging** via enterprise policy

### Priority 2: Short-Term (Month 1-2)

6. **Deploy DBSC** for Google Workspace environments
7. **Enable Credential Guard** on all Windows 11 Enterprise endpoints
8. **Enable HVCI** enterprise-wide (verify driver compatibility first)
9. **Implement application allowlisting** or Smart App Control
10. **Deploy dark web monitoring** for corporate credential exposure (SpyCloud, Flare, SOCRadar)

### Priority 3: Medium-Term (Quarter 1-2)

11. **Accelerate passkey/FIDO2 adoption** -- target 100% for privileged accounts by Q2 2026
12. **Deploy ITDR (Identity Threat Detection and Response)** across all identity stores
13. **Implement Zero Trust architecture** with microsegmentation
14. **Deploy browser isolation** for high-value user segments
15. **Eliminate BYOD access** to sensitive corporate resources or require managed browser

### Priority 4: Ongoing

16. **Continuous credential monitoring** via dark web intelligence platforms
17. **Regular purple team exercises** specifically testing infostealer TTPs
18. **Maintain detection rules** -- update YARA/Sigma/KQL as new families emerge
19. **Monitor for HVCI/CET bypass attempts** -- attackers will try to disable

---

## 7. Post-Compromise: Detecting Stolen Credentials in Use

### 7.1 Indicators of Stolen Credential Use

| Indicator | Detection Method |
|-----------|-----------------|
| **Impossible travel** | Login from geographically impossible locations within timeframe |
| **New device + known creds** | DBSC failure (no TPM proof); device fingerprint mismatch |
| **Anti-detect browser fingerprint** | Canvas fingerprint anomalies, WebGL hash mismatches, timezone/language inconsistencies |
| **Session cookie replay** | Same session ID from different IP/device; cookie used without prior auth flow |
| **Credential stuffing patterns** | High-velocity auth attempts across multiple accounts from same IP range |
| **Abnormal access patterns** | Accessing resources the user never accessed before; bulk data download |

### 7.2 SIEM Detection Rules for Stolen Credential Use

```kql
// Impossible travel detection
SigninLogs
| where ResultType == 0
| summarize by UserPrincipalName, IPAddress, Location, TimeGenerated
| join kind=inner (
    SigninLogs
    | where ResultType == 0
    | summarize by UserPrincipalName, IPAddress, Location, TimeGenerated
) on UserPrincipalName
| where TimeGenerated1 > TimeGenerated and datetime_diff('minute', TimeGenerated1, TimeGenerated) < 60
| where Location != Location1
```

```kql
// Session token reuse from new device
AADSignInEventsBeta
| where SessionId != ""
| summarize DeviceCount=dcount(DeviceName), IPs=make_set(IPAddress) by SessionId, AccountUpn
| where DeviceCount > 1
```

### 7.3 Dark Web Monitoring Integration

Deploy continuous monitoring for:
- Corporate email addresses in stealer logs (Telegram channels, Genesis Market successors, Russian Market)
- Session cookies for corporate domains
- Corporate VPN credentials
- SSO/SAML tokens
- API keys and service account credentials

**Response SLA when detected:**
- Privileged accounts: Immediate password reset + session revocation (< 1 hour)
- Standard accounts: Reset within 4 hours
- Service accounts: Rotate credentials within 24 hours
- All: Review access logs for signs of unauthorized use during exposure window

---

## 8. The Modern Stealer Kill Chain and Where to Break It

```
[1] Delivery        --> Smart App Control, application allowlisting, email filtering
        |
[2] Execution       --> ASR rules, HVCI, CET, EDR behavioral detection
        |
[3] Credential      --> Credential Guard (OS creds), LSASS PPL, browser DB access
    Harvesting          monitoring, DPAPI monitoring
        |
[4] Session/Cookie  --> DBSC (device binding), short TTL, App-Bound Encryption
    Theft
        |
[5] Data Staging    --> File access monitoring, DLP, clipboard monitoring
        |
[6] Exfiltration    --> NDR, DNS monitoring, outbound traffic analysis
        |
[7] Credential Use  --> Impossible travel, DBSC validation failure, dark web monitoring,
    (by attacker)       Zero Trust continuous verification
```

**Highest-impact intervention points:**
1. **Stage 1 (Delivery):** Prevent execution entirely -- highest ROI
2. **Stage 4 (Cookie Theft):** DBSC makes stolen cookies worthless -- neutralizes the primary stealer objective
3. **Stage 7 (Credential Use):** Zero Trust + continuous monitoring catches what prevention missed

---

## 9. Summary: Defender's Prioritized Checklist

### Must-Have (Non-Negotiable)
- [ ] ASR rules in Block mode (especially LSASS protection)
- [ ] LSASS PPL enabled
- [ ] Credential Guard enabled (Windows 11 Enterprise)
- [ ] HVCI enabled
- [ ] Session cookie TTL reduced to 1 hour
- [ ] Chrome remote debugging blocked via policy
- [ ] Sysmon deployed with credential-theft config
- [ ] Detection rules for browser DB access by non-browser processes

### Should-Have (High Impact)
- [ ] DBSC enabled for Google Workspace
- [ ] Passkeys/FIDO2 for privileged accounts
- [ ] Dark web credential monitoring
- [ ] Application allowlisting or Smart App Control
- [ ] Zero Trust with microsegmentation
- [ ] ITDR across identity stores

### Nice-to-Have (Defense in Depth)
- [ ] Browser isolation for high-value users
- [ ] BYOD elimination for sensitive access
- [ ] Purple team exercises for stealer TTPs
- [ ] AI-powered behavioral analytics (Vectra, CrowdStrike Charlotte AI)

---

## Sources

- [Vectra: Infostealers stole 1.8B credentials in 2025](https://www.vectra.ai/topics/infostealers)
- [Flashpoint: Proactive Defender's Guide to Infostealers](https://flashpoint.io/blog/proactive-defender-guide-infostealers/)
- [Flashpoint: Infostealer Gateway -- Defense Evasion Methods](https://flashpoint.io/blog/the-infostealer-gateway-uncovering-latest-methods-defense-evasion/)
- [DeepStrike: Infostealer Malware in 2025](https://deepstrike.io/blog/infostealer-malware-credential-theft-2025)
- [Chrome DBSC Developer Documentation](https://developer.chrome.com/docs/web-platform/device-bound-session-credentials)
- [Google Workspace: DBSC Session Binding](https://support.google.com/a/answer/15956470)
- [Google Workspace Blog: Defending with Passkeys and DBSC](https://workspace.google.com/blog/identity-and-security/defending-against-account-takeovers-top-threats-passkeys-and-dbsc)
- [Elastic Security Labs: Globally Distributed Stealers](https://www.elastic.co/security-labs/globally-distributed-stealers)
- [Elastic YARA Rules: Windows_Trojan_Lumma](https://github.com/elastic/protections-artifacts/blob/main/yara/rules/Windows_Trojan_Lumma.yar)
- [Elastic YARA Rules: Windows_Infostealer_Generic](https://github.com/elastic/protections-artifacts/blob/main/yara/rules/Windows_Infostealer_Generic.yar)
- [Microsoft: Lumma Stealer Analysis](https://www.microsoft.com/en-us/security/blog/2025/05/21/lumma-stealer-breaking-down-the-delivery-techniques-and-capabilities-of-a-prolific-infostealer/)
- [Microsoft: Detecting and Preventing LSASS Credential Dumping](https://www.microsoft.com/en-us/security/blog/2022/10/05/detecting-and-preventing-lsass-credential-dumping-attacks/)
- [Microsoft: ASR Rules Reference](https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference)
- [Microsoft: Credential Guard Overview](https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/)
- [Microsoft: HVCI Configuration](https://learn.microsoft.com/en-us/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity)
- [Intel CET Technical Overview](https://www.intel.com/content/www/us/en/developer/articles/technical/technical-look-control-flow-enforcement-technology.html)
- [SpecterOps: Catching Credential Guard Off Guard](https://specterops.io/blog/2025/10/23/catching-credential-guard-off-guard/)
- [Connor McGarr: Kernel Mode Shadow Stacks](https://connormcgarr.github.io/km-shadow-stacks/)
- [Synacktiv: Windows Kernel Shadow Stack Mitigation Analysis](https://www.synacktiv.com/sites/default/files/2025-06/sstic_windows_kernel_shadow_stack_mitigation.pdf)
- [BlackHat USA 2025: KCFG and KCET](https://i.blackhat.com/BH-USA-25/Presentations/USA-25-McGarr-Out-Of-Control-KCFG-And-KCET.pdf)
- [Chrome Blog: Remote Debugging Port Security Changes](https://developer.chrome.com/blog/remote-debugging-port)
- [MITRE ATT&CK: Process Hollowing T1055.012](https://attack.mitre.org/techniques/T1055/012/)
- [MITRE ATT&CK: Credentials from Web Browsers T1555.003](https://www.startupdefense.io/mitre-attack-techniques/t1555-003-credentials-from-web-browsers)
- [SigmaHQ: Sigma Rule Repository](https://github.com/SigmaHQ/sigma)
- [Splunk: LSASS Credential Dumping Detection](https://research.splunk.com/endpoint/2c365e57-4414-4540-8dc0-73ab10729996/)
- [W3C: DBSC First Public Working Draft](https://www.w3.org/news/2025/first-public-working-draft-device-bound-session-credentials/)
- [Darknet: Credential Stuffing in 2025](https://www.darknet.org.uk/2026/03/credential-stuffing-in-2025-how-combolists-infostealers-and-account-takeover-became-an-industry/)
- [Panorays: Cyber Threat Landscape 2026](https://panorays.com/blog/cyber-threat-landscape-2026-emerging-risks/)
- [Cyble: Dark Web Monitoring 2026 Trends](https://cyble.com/knowledge-hub/dark-web-monitoring-trends/)
- [Israel CERT: Hunting Infostealers Practical Approach (Jan 2025)](https://www.gov.il/BlobFolder/reports/alert_1848/he/ALERT-CERT-IL-W-1848.pdf)
- [VMRay: May 2025 YARA Detection Highlights](https://www.vmray.com/may-2025-detection-highlights-vmray-threat-identifiers-config-extractors-yara-rules/)
- [Endpoint Evasion Techniques 2020-2025](https://windshock.github.io/en/post/2025-05-28-endpoint-security-evasion-techniques-20202025/)
- [Packetlabs: Hackers Beat Chrome's App-Bound Encryption](https://www.packetlabs.net/posts/hackers-beat-chromes-app-bound-encryption-for-session-hijacking/)
- [Jeff Appel: Credential Dumps with Defender for Endpoint](https://jeffreyappel.nl/detect-and-block-credential-dumps-with-defender-for-endpoint-attack-surface-reduction/)