APT-Hunter – Threat Hunting Tool via Windows Event Log

DumpBrowserSecrets is a publicly documented post‑exploitation tool that harvests credentials and session tokens from major Windows browsers (Chrome/Edge/Brave via App‑Bound Encryption bypass, Opera/Vivaldi via DPAPI, and Firefox via NSS decryption). The report explains the executable + DLL architecture, IElevator COM-based App‑Bound Encryption decryption performed by injecting a DLL into a headless Chromium process using Early Bird APC injection, extraction and decryption of browser SQLite/JSON stores, operational evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, handle duplication), example attack scenarios, and recommended detection and mitigation points.