From 5ac022bdfba2edbe8f95b694f0adc298a3a83eb3 Mon Sep 17 00:00:00 2001 From: Teoderick Contreras Date: Thu, 18 Dec 2025 15:30:28 +0100 Subject: [PATCH 1/3] browser_hijack --- ...rome_auto_update_disabled_via_registry.yml | 72 +++++++++++++++++++ ...ble_extension_loading_via_command_line.yml | 71 ++++++++++++++++++ ...xtension_allowed_registry_modification.yml | 65 +++++++++++++++++ ...chrome_extension_load_via_command_line.yml | 71 ++++++++++++++++++ stories/browser_hijacking.yml | 20 ++++++ 5 files changed, 299 insertions(+) create mode 100644 detections/endpoint/windows_chrome_auto_update_disabled_via_registry.yml create mode 100644 detections/endpoint/windows_chrome_enable_extension_loading_via_command_line.yml create mode 100644 detections/endpoint/windows_chrome_extension_allowed_registry_modification.yml create mode 100644 detections/endpoint/windows_chrome_extension_load_via_command_line.yml create mode 100644 stories/browser_hijacking.yml diff --git a/detections/endpoint/windows_chrome_auto_update_disabled_via_registry.yml b/detections/endpoint/windows_chrome_auto_update_disabled_via_registry.yml new file mode 100644 index 0000000000..6d865fd6f4 --- /dev/null +++ b/detections/endpoint/windows_chrome_auto_update_disabled_via_registry.yml @@ -0,0 +1,72 @@ +name: Windows Chrome Auto-Update Disabled via Registry +id: 619eac6c-0f03-4699-ae29-5f337877bcf9 +version: 1 +date: '2025-12-17' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects modifications to Windows registry keys that disable Google Chrome auto-updates. Changes to keys such as DisableAutoUpdateChecksCheckboxValue = 1, Update{8A69D345-D564-463C-AFF1-A69D9E530F96} = 0, UpdateDefault = 0, and AutoUpdateCheckPeriodMinutes = 0 can prevent Chrome from receiving security updates. This behavior may indicate attempts to bypass update policies, maintain unauthorized extensions, or facilitate malware persistence. Monitoring these registry changes helps identify potential policy violations or malicious activity targeting browser security. +data_source: +- Sysmon EventID 13 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + + where Registry.registry_path = "*\\Google\\Update*" AND + (Registry.registry_value_name = "DisableAutoUpdateChecksCheckboxValue" AND Registry.registry_value_data = 0x00000001) OR + (Registry.registry_value_name = "Update{8A69D345-D564-463C-AFF1-A69D9E530F96}" AND Registry.registry_value_data = 0x00000000) OR + (Registry.registry_value_name = "UpdateDefault" AND Registry.registry_value_data = 0x00000000) OR + (Registry.registry_value_name = "AutoUpdateCheckPeriodMinutes" AND Registry.registry_value_data = 0x00000000) + + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_chrome_auto_update_disabled_via_registry_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the official + Sysmon TA. https://splunkbase.splunk.com/app/5709 +known_false_positives: IT administrators intentionally disabling auto-updates in managed environments for testing, compatibility, or deployment purposes. +references: +- https://www.gdatasoftware.com/blog/2025/11/38298-learning-about-browser-hijacking +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Chrome Auto-update in $registry_path$ was disabled on $dest$ + risk_objects: + - field: dest + type: system + score: 20 + threat_objects: [] +tags: + analytic_story: + - Browser Hijacking + asset_type: Endpoint + mitre_attack_id: + - T1185 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/disable_chrome_update/disable_chrome_update.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/endpoint/windows_chrome_enable_extension_loading_via_command_line.yml b/detections/endpoint/windows_chrome_enable_extension_loading_via_command_line.yml new file mode 100644 index 0000000000..52d1adb724 --- /dev/null +++ b/detections/endpoint/windows_chrome_enable_extension_loading_via_command_line.yml @@ -0,0 +1,71 @@ +name: Windows Chrome Enable Extension Loading via Command-Line +id: da355155-1d23-48f9-bf95-e534ae273ab0 +version: 1 +date: '2025-12-17' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects instances where Google Chrome is started with the --disable-features=DisableLoadExtensionCommandLineSwitch flag, effectively enabling the loading of extensions via the command line. This may indicate attempts to bypass enterprise extension policies, load unauthorized or malicious extensions, or manipulate browser behavior. Monitoring this activity helps identify potential security policy violations, malware persistence techniques, or other suspicious Chrome modifications. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "Chrome.exe" Processes.process= "*--disable-features=DisableLoadExtensionCommandLineSwitch*" + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_chrome_enable_extension_loading_via_command_line_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Developers or IT admins loading unpacked extensions for testing or deployment purposes. +references: +- https://www.gdatasoftware.com/blog/2025/11/38298-learning-about-browser-hijacking +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: a chrome.exe process commandline $process$ that enable browser extension loading in commandline on $dest$. + risk_objects: + - field: dest + type: system + score: 30 + threat_objects: + - field: parent_process_name + type: parent_process_name +tags: + analytic_story: + - Browser Hijacking + asset_type: Endpoint + mitre_attack_id: + - T1185 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/chrome_load_extensions/chrome_load_extension.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/endpoint/windows_chrome_extension_allowed_registry_modification.yml b/detections/endpoint/windows_chrome_extension_allowed_registry_modification.yml new file mode 100644 index 0000000000..84d4c688c0 --- /dev/null +++ b/detections/endpoint/windows_chrome_extension_allowed_registry_modification.yml @@ -0,0 +1,65 @@ +name: 'Windows Chrome Extension Allowed Registry Modification' +id: 2846089a-ffe9-4881-a2a2-43f3be2b8cc7 +version: 1 +date: '2025-12-17' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects modifications to the Windows registry keys that control the Chrome Extension Install Allowlist. Unauthorized changes to these keys may indicate attempts to bypass Chrome extension restrictions or install unapproved extensions. This detection helps identify potential security policy violations or malicious activity targeting Chrome extension settings. +data_source: +- Sysmon EventID 13 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path = "*\\Google\\Chrome\\ExtensionInstallAllowlist*" + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_chrome_extension_allowed_registry_modification_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the official + Sysmon TA. https://splunkbase.splunk.com/app/5709 +known_false_positives: Legitimate IT admin updates to Chrome extension allowlist via Group Policy or enterprise management tools. Filtering is needed. +references: +- https://www.gdatasoftware.com/blog/2025/11/38298-learning-about-browser-hijacking +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: ExtensionInstallAllowlist Policy in $registry_path$ was modified on $dest$ + risk_objects: + - field: dest + type: system + score: 30 + threat_objects: [] +tags: + analytic_story: + - Browser Hijacking + asset_type: Endpoint + mitre_attack_id: + - T1185 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/chrome_allow_list/chrome_extension_allow_list.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_chrome_extension_load_via_command_line.yml b/detections/endpoint/windows_chrome_extension_load_via_command_line.yml new file mode 100644 index 0000000000..5048ec4c80 --- /dev/null +++ b/detections/endpoint/windows_chrome_extension_load_via_command_line.yml @@ -0,0 +1,71 @@ +name: Windows Chrome Extension Load via Command-Line +id: 1b8a468a-52e3-4206-b14a-73165441684c +version: 1 +date: '2025-12-17' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects instances where Google Chrome is started with the --load-extension command-line flag, which allows loading unpacked or non-standard extensions. This behavior can indicate attempts to bypass enterprise extension policies, install malicious extensions, or load potentially harmful browser components. Monitoring such activity helps identify unauthorized extension usage, potential malware persistence mechanisms, or policy violations that could compromise browser security. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "Chrome.exe" Processes.process= "*--load-extension*" + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_chrome_extension_load_via_command_line_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Developers or IT admins loading unpacked extensions for testing or deployment purposes. +references: +- https://www.gdatasoftware.com/blog/2025/11/38298-learning-about-browser-hijacking +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: a chrome.exe process commandline $process$ that load browser extension on $dest$. + risk_objects: + - field: dest + type: system + score: 20 + threat_objects: + - field: parent_process_name + type: parent_process_name +tags: + analytic_story: + - Browser Hijacking + asset_type: Endpoint + mitre_attack_id: + - T1185 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/chrome_load_extensions/chrome_load_extension.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/stories/browser_hijacking.yml b/stories/browser_hijacking.yml new file mode 100644 index 0000000000..75984892cb --- /dev/null +++ b/stories/browser_hijacking.yml @@ -0,0 +1,20 @@ +name: Browser Hijacking +id: 530d884d-c40f-4da2-bcd6-11d36b36f6ee +version: 1 +date: '2025-12-18' +author: Teoderick Contreras, Splunk +status: production +description: These behaviors associated with browser hijacking techniques where malware manipulates browser configurations, preferences, or registry settings to alter browsing behavior, disable updates, and install unauthorized extensions. Modern hijackers may directly modify Chrome preference files, use automation to inject unwanted content, or change policy settings (including allowlisting extensions) to persist and evade standard protections. These actions often result in unwanted redirects, malicious extension loading, or persistent policy tampering that can compromise user browsing integrity and system security. Detecting such modifications helps identify potential hijacker activity early and supports incident response efforts. +narrative: Browser hijacking is a common tactic used by malicious actors to gain control over a user’s browsing experience, often without their knowledge. Attackers manipulate browser settings, install unauthorized extensions, or modify registry keys to redirect traffic, inject ads, or persistently override security policies. In Chrome, this can include altering the Extension Install Allowlist or preference files to load malicious or unwanted extensions automatically. Such modifications not only degrade user experience but can also introduce malware, credential theft, or data leakage. Detecting these registry and policy changes provides early warning of hijacker activity, enabling timely remediation before wider compromise occurs. +references: +- https://www.gdatasoftware.com/blog/2025/11/38298-learning-about-browser-hijacking +tags: + category: + - Data Destruction + - Malware + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection From 9f3268744e13e2a319e89fd704b7d33fe00b8f9d Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 9 Jan 2026 14:30:52 +0530 Subject: [PATCH 2/3] remove quote --- .../windows_chrome_extension_allowed_registry_modification.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_chrome_extension_allowed_registry_modification.yml b/detections/endpoint/windows_chrome_extension_allowed_registry_modification.yml index 84d4c688c0..983830a77c 100644 --- a/detections/endpoint/windows_chrome_extension_allowed_registry_modification.yml +++ b/detections/endpoint/windows_chrome_extension_allowed_registry_modification.yml @@ -1,4 +1,4 @@ -name: 'Windows Chrome Extension Allowed Registry Modification' +name: Windows Chrome Extension Allowed Registry Modification id: 2846089a-ffe9-4881-a2a2-43f3be2b8cc7 version: 1 date: '2025-12-17' From cbd4a7975bbd5d9e573a6519a180935b188ec2d3 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Mon, 12 Jan 2026 12:44:29 +0100 Subject: [PATCH 3/3] update metadata --- ...rome_auto_update_disabled_via_registry.yml | 84 +++++++++++-------- ...ble_extension_loading_via_command_line.yml | 57 ++++++++----- ...xtension_allowed_registry_modification.yml | 14 ++-- ...chrome_extension_load_via_command_line.yml | 71 ---------------- ...cess_loaded_extension_via_command_line.yml | 80 ++++++++++++++++++ stories/browser_hijacking.yml | 18 ++-- 6 files changed, 181 insertions(+), 143 deletions(-) delete mode 100644 detections/endpoint/windows_chrome_extension_load_via_command_line.yml create mode 100644 detections/endpoint/windows_chromium_process_loaded_extension_via_command_line.yml diff --git a/detections/endpoint/windows_chrome_auto_update_disabled_via_registry.yml b/detections/endpoint/windows_chrome_auto_update_disabled_via_registry.yml index 6d865fd6f4..d49d0e0050 100644 --- a/detections/endpoint/windows_chrome_auto_update_disabled_via_registry.yml +++ b/detections/endpoint/windows_chrome_auto_update_disabled_via_registry.yml @@ -1,36 +1,54 @@ name: Windows Chrome Auto-Update Disabled via Registry id: 619eac6c-0f03-4699-ae29-5f337877bcf9 version: 1 -date: '2025-12-17' +date: '2026-01-12' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects modifications to Windows registry keys that disable Google Chrome auto-updates. Changes to keys such as DisableAutoUpdateChecksCheckboxValue = 1, Update{8A69D345-D564-463C-AFF1-A69D9E530F96} = 0, UpdateDefault = 0, and AutoUpdateCheckPeriodMinutes = 0 can prevent Chrome from receiving security updates. This behavior may indicate attempts to bypass update policies, maintain unauthorized extensions, or facilitate malware persistence. Monitoring these registry changes helps identify potential policy violations or malicious activity targeting browser security. +description: | + The following analytic detects modifications to Windows registry values that disable Google Chrome auto-updates. + Changes to values such as DisableAutoUpdateChecksCheckboxValue = 1, Update{8A69D345-D564-463C-AFF1-A69D9E530F96} = 0, UpdateDefault = 0, and AutoUpdateCheckPeriodMinutes = 0 can prevent Chrome from receiving security updates. + This behavior may indicate attempts to bypass update policies, maintain unauthorized extensions, or facilitate malware persistence. + Monitoring these registry changes helps identify potential policy violations or malicious activity targeting browser security. data_source: -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry - - where Registry.registry_path = "*\\Google\\Update*" AND - (Registry.registry_value_name = "DisableAutoUpdateChecksCheckboxValue" AND Registry.registry_value_data = 0x00000001) OR - (Registry.registry_value_name = "Update{8A69D345-D564-463C-AFF1-A69D9E530F96}" AND Registry.registry_value_data = 0x00000000) OR - (Registry.registry_value_name = "UpdateDefault" AND Registry.registry_value_data = 0x00000000) OR - (Registry.registry_value_name = "AutoUpdateCheckPeriodMinutes" AND Registry.registry_value_data = 0x00000000) - - by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path - Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + - Sysmon EventID 13 +search: | + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + + where Registry.registry_path = "*\\Google\\Update*" + AND + ( + Registry.registry_value_name = "DisableAutoUpdateChecksCheckboxValue" + Registry.registry_value_data = 0x00000001 + ) + OR + ( + Registry.registry_value_name IN ( + "AutoUpdateCheckPeriodMinutes", + "Update{8A69D345-D564-463C-AFF1-A69D9E530F96}", + "UpdateDefault" + ) + Registry.registry_value_data = 0x00000000 + ) + + by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_chrome_auto_update_disabled_via_registry_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_chrome_auto_update_disabled_via_registry_filter` +how_to_implement: | + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 -known_false_positives: IT administrators intentionally disabling auto-updates in managed environments for testing, compatibility, or deployment purposes. +known_false_positives: | + IT administrators intentionally disabling auto-updates in managed environments for testing, compatibility, or deployment purposes. references: -- https://www.gdatasoftware.com/blog/2025/11/38298-learning-about-browser-hijacking + - https://www.gdatasoftware.com/blog/2025/11/38298-learning-about-browser-hijacking drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -49,24 +67,24 @@ drilldown_searches: rba: message: Chrome Auto-update in $registry_path$ was disabled on $dest$ risk_objects: - - field: dest - type: system - score: 20 + - field: dest + type: system + score: 20 threat_objects: [] tags: analytic_story: - - Browser Hijacking + - Browser Hijacking asset_type: Endpoint mitre_attack_id: - - T1185 + - T1185 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/disable_chrome_update/disable_chrome_update.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog \ No newline at end of file + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/disable_chrome_update/disable_chrome_update.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_chrome_enable_extension_loading_via_command_line.yml b/detections/endpoint/windows_chrome_enable_extension_loading_via_command_line.yml index 52d1adb724..6ccc04f19c 100644 --- a/detections/endpoint/windows_chrome_enable_extension_loading_via_command_line.yml +++ b/detections/endpoint/windows_chrome_enable_extension_loading_via_command_line.yml @@ -1,26 +1,33 @@ name: Windows Chrome Enable Extension Loading via Command-Line id: da355155-1d23-48f9-bf95-e534ae273ab0 version: 1 -date: '2025-12-17' +date: '2026-01-12' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects instances where Google Chrome is started with the --disable-features=DisableLoadExtensionCommandLineSwitch flag, effectively enabling the loading of extensions via the command line. This may indicate attempts to bypass enterprise extension policies, load unauthorized or malicious extensions, or manipulate browser behavior. Monitoring this activity helps identify potential security policy violations, malware persistence techniques, or other suspicious Chrome modifications. +description: | + The following analytic detects instances where Google Chrome is started with the --disable-features=DisableLoadExtensionCommandLineSwitch flag, effectively enabling the loading of extensions via the command line. + This may indicate attempts to bypass enterprise extension policies, load unauthorized or malicious extensions, or manipulate browser behavior. + Monitoring this activity helps identify potential security policy violations, malware persistence techniques, or other suspicious Chrome modifications. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = "Chrome.exe" Processes.process= "*--disable-features=DisableLoadExtensionCommandLineSwitch*" +search: | + | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime + from datamodel=Endpoint.Processes where + Processes.process_name = "Chrome.exe" + Processes.process= "*--disable-features*" + Processes.process= "*DisableLoadExtensionCommandLineSwitch*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process - Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id - Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec - Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_chrome_enable_extension_loading_via_command_line_filter`' + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_chrome_enable_extension_loading_via_command_line_filter` how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -44,7 +51,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: a chrome.exe process commandline $process$ that enable browser extension loading in commandline on $dest$. + message: A $process_name$ process attempted to enable browser extension loading via command line $process$ on $dest$. risk_objects: - field: dest type: system @@ -52,20 +59,24 @@ rba: threat_objects: - field: parent_process_name type: parent_process_name + - field: process_name + type: process_name + - field: process + type: process tags: analytic_story: - - Browser Hijacking + - Browser Hijacking asset_type: Endpoint mitre_attack_id: - - T1185 + - T1185 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/chrome_load_extensions/chrome_load_extension.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog \ No newline at end of file + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/chrome_load_extensions/chrome_load_extension.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_chrome_extension_allowed_registry_modification.yml b/detections/endpoint/windows_chrome_extension_allowed_registry_modification.yml index 983830a77c..397bfc4d74 100644 --- a/detections/endpoint/windows_chrome_extension_allowed_registry_modification.yml +++ b/detections/endpoint/windows_chrome_extension_allowed_registry_modification.yml @@ -1,21 +1,21 @@ name: Windows Chrome Extension Allowed Registry Modification id: 2846089a-ffe9-4881-a2a2-43f3be2b8cc7 version: 1 -date: '2025-12-17' +date: '2026-01-12' author: Teoderick Contreras, Splunk status: production type: Anomaly description: The following analytic detects modifications to the Windows registry keys that control the Chrome Extension Install Allowlist. Unauthorized changes to these keys may indicate attempts to bypass Chrome extension restrictions or install unapproved extensions. This detection helps identify potential security policy violations or malicious activity targeting Chrome extension settings. data_source: -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + - Sysmon EventID 13 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path = "*\\Google\\Chrome\\ExtensionInstallAllowlist*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_chrome_extension_allowed_registry_modification_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -40,7 +40,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: ExtensionInstallAllowlist Policy in $registry_path$ was modified on $dest$ + message: Chrome ExtensionInstallAllowlist Policy in $registry_path$ was modified on $dest$ risk_objects: - field: dest type: system diff --git a/detections/endpoint/windows_chrome_extension_load_via_command_line.yml b/detections/endpoint/windows_chrome_extension_load_via_command_line.yml deleted file mode 100644 index 5048ec4c80..0000000000 --- a/detections/endpoint/windows_chrome_extension_load_via_command_line.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Windows Chrome Extension Load via Command-Line -id: 1b8a468a-52e3-4206-b14a-73165441684c -version: 1 -date: '2025-12-17' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic detects instances where Google Chrome is started with the --load-extension command-line flag, which allows loading unpacked or non-standard extensions. This behavior can indicate attempts to bypass enterprise extension policies, install malicious extensions, or load potentially harmful browser components. Monitoring such activity helps identify unauthorized extension usage, potential malware persistence mechanisms, or policy violations that could compromise browser security. -data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = "Chrome.exe" Processes.process= "*--load-extension*" - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process - Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id - Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec - Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_chrome_extension_load_via_command_line_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Developers or IT admins loading unpacked extensions for testing or deployment purposes. -references: -- https://www.gdatasoftware.com/blog/2025/11/38298-learning-about-browser-hijacking -drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -rba: - message: a chrome.exe process commandline $process$ that load browser extension on $dest$. - risk_objects: - - field: dest - type: system - score: 20 - threat_objects: - - field: parent_process_name - type: parent_process_name -tags: - analytic_story: - - Browser Hijacking - asset_type: Endpoint - mitre_attack_id: - - T1185 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/chrome_load_extensions/chrome_load_extension.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_chromium_process_loaded_extension_via_command_line.yml b/detections/endpoint/windows_chromium_process_loaded_extension_via_command_line.yml new file mode 100644 index 0000000000..0eba2e5de9 --- /dev/null +++ b/detections/endpoint/windows_chromium_process_loaded_extension_via_command_line.yml @@ -0,0 +1,80 @@ +name: Windows Chromium Process Loaded Extension via Command-Line +id: 1b8a468a-52e3-4206-b14a-73165441684c +version: 1 +date: '2026-01-12' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: | + The following analytic detects instances where Google Chrome is started with the --load-extension command-line flag, which allows loading unpacked or non-standard extensions. This behavior can indicate attempts to bypass enterprise extension policies, install malicious extensions, or load potentially harmful browser components. Monitoring such activity helps identify unauthorized extension usage, potential malware persistence mechanisms, or policy violations that could compromise browser security. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: | + | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where + Processes.process_name = "Chrome.exe" + Processes.process= "*--load-extension*" + + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_chromium_process_loaded_extension_via_command_line_filter` +how_to_implement: | + To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Developers or IT admins loading unpacked extensions for testing or deployment purposes. +references: + - https://www.gdatasoftware.com/blog/2025/11/38298-learning-about-browser-hijacking +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A $process_name$ process attempted to load an extension via the commandline $process$ on $dest$. + risk_objects: + - field: dest + type: system + score: 20 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name + - field: process + type: process +tags: + analytic_story: + - Browser Hijacking + asset_type: Endpoint + mitre_attack_id: + - T1185 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/chrome_load_extensions/chrome_load_extension.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/stories/browser_hijacking.yml b/stories/browser_hijacking.yml index 75984892cb..a27ea90767 100644 --- a/stories/browser_hijacking.yml +++ b/stories/browser_hijacking.yml @@ -1,20 +1,20 @@ name: Browser Hijacking id: 530d884d-c40f-4da2-bcd6-11d36b36f6ee version: 1 -date: '2025-12-18' +date: '2026-01-12' author: Teoderick Contreras, Splunk status: production description: These behaviors associated with browser hijacking techniques where malware manipulates browser configurations, preferences, or registry settings to alter browsing behavior, disable updates, and install unauthorized extensions. Modern hijackers may directly modify Chrome preference files, use automation to inject unwanted content, or change policy settings (including allowlisting extensions) to persist and evade standard protections. These actions often result in unwanted redirects, malicious extension loading, or persistent policy tampering that can compromise user browsing integrity and system security. Detecting such modifications helps identify potential hijacker activity early and supports incident response efforts. -narrative: Browser hijacking is a common tactic used by malicious actors to gain control over a user’s browsing experience, often without their knowledge. Attackers manipulate browser settings, install unauthorized extensions, or modify registry keys to redirect traffic, inject ads, or persistently override security policies. In Chrome, this can include altering the Extension Install Allowlist or preference files to load malicious or unwanted extensions automatically. Such modifications not only degrade user experience but can also introduce malware, credential theft, or data leakage. Detecting these registry and policy changes provides early warning of hijacker activity, enabling timely remediation before wider compromise occurs. +narrative: Browser hijacking is a common tactic used by malicious actors to gain control over a user's browsing experience, often without their knowledge. Attackers manipulate browser settings, install unauthorized extensions, or modify registry keys to redirect traffic, inject ads, or persistently override security policies. In Chrome, this can include altering the Extension Install Allowlist or preference files to load malicious or unwanted extensions automatically. Such modifications not only degrade user experience but can also introduce malware, credential theft, or data leakage. Detecting these registry and policy changes provides early warning of hijacker activity, enabling timely remediation before wider compromise occurs. references: -- https://www.gdatasoftware.com/blog/2025/11/38298-learning-about-browser-hijacking + - https://www.gdatasoftware.com/blog/2025/11/38298-learning-about-browser-hijacking tags: category: - - Data Destruction - - Malware - - Adversary Tactics + - Data Destruction + - Malware + - Adversary Tactics product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud usecase: Advanced Threat Detection