Detecting browser data theft using Windows Event Logs

The report describes a practical detection method to identify theft of Chromium-based browser cookies and credentials on Windows by enabling DPAPI auditing and Crypto-DPAPI debug logging, then correlating event 16385 (SPCryptUnprotect with browser DataDescription) to process creation event 4688 to flag non-browser processes accessing protected data; it includes configuration steps and a demonstration using a Python password stealer to show how to generate alerts.