Chrome Browser Spawned from an Unusual Parent

[rule]
description = """
Identifies instances where an unusual process spawns a chrome browser child process. This behavior could be related to
malwares stealing browser information.
"""
id = "fcbeaab7-017f-4bba-8b27-ffe68d64a28c"
license = "Elastic License v2"
name = "Chrome Browser Spawned from an Unusual Parent"
os_list = ["windows"]
version = "1.0.7"

query = '''
process where event.type == "start" and
 process.name : "chrome.exe" and process.args in~ ("--profile-directory=\"Default\"", "--profile-directory=Default") and
 process.parent.executable != null and
 not process.parent.executable in~
                     ("c:\\windows\\explorer.exe",
                      "c:\\program files\\google\\chrome\\application\\chrome_proxy.exe",
                      "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome_proxy.exe",
                      "c:\\program files\\google\\chrome\\application\\chrome.exe",
                      "c:\\Program Files (x86)\\google\\chrome\\application\\chrome.exe",
                      "C:\\Windows\\System32\\rdpinit.exe",
                      "C:\\Windows\\System32\\sihost.exe",
                      "C:\\Windows\\System32\\RuntimeBroker.exe",
                      "C:\\Windows\\System32\\SECOCL64.exe") and
 not process.parent.executable : (
                      "C:\\Windows\\System32\\DriverStore\\FileRepository\\seapo64.inf_*\\SECOCL64.exe", 
                      "C:\\Program Files\\OutSystems\\Service Studio ??\\Service Studio\\ServiceStudio.exe",
                      "C:\\Windows\\System32\\DriverStore\\FileRepository\\snapo64.inf_amd64_*\\SNAPOS64.exe",
                      "C:\\Program Files\\WindowsApps\\*.exe") and
 not (process.parent.code_signature.subject_name in (
        "Google LLC", "Sound Research Corporation", "FactSet Research Systems Inc."
      ) and process.parent.code_signature.trusted == true) and
 not (process.parent.name : "cmd.exe" and process.parent.args : "*\\Desktop\\*.bat " and process.args : "--profile-directory=Default") and
 not (process.parent.name == "chromedriver.exe" and process.args == "--test-type=webdriver") and
 not (process.parent.name == "gralvior-desktop.exe" and process.args == "https://google.com") and
 not (process.parent.name == "rundll32.exe" and process.parent.args == "C:\\windows\\System32\\SHELL32.dll,RunAsNewUser_RunDLL") and
 not (process.parent.code_signature.subject_name in ("AMARYLLIS SIGNAL LTD", "BLUE TAKIN LTD", "METROPOLITAN DESIGN LLC") and process.parent.code_signature.trusted == true)
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1539"
name = "Steal Web Session Cookie"
reference = "https://attack.mitre.org/techniques/T1539/"

[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.003"
name = "Credentials from Web Browsers"
reference = "https://attack.mitre.org/techniques/T1555/003/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.10.0"