Chromium Extension Loaded from Unusual Parent

[rule]
description = """
Detects the manual loading of a Chromium extension from an unusual parent process. This activity is suspicious and could
be indicative of a malware loading a malicious extension to persist or collect browsing secrets such as cookies,
browsing history.
"""
id = "d7fda3d7-fe77-49c2-8b50-d28a6da206c4"
license = "Elastic License v2"
name = "Chromium Extension Loaded from Unusual Parent"
os_list = ["windows"]
reference = [
    "https://redcanary.com/blog/chromeloader/",
    "https://blogs.vmware.com/security/2022/09/the-evolution-of-the-chromeloader-malware.html",
]
version = "1.0.27"

query = '''
sequence with maxspan=5m
 [process where event.action == "start" and process.parent.executable != null and
  (
   (process.Ext.relative_file_creation_time <= 600 or process.Ext.relative_file_name_modify_time <= 600) or
   process.executable : ("?:\\Users\\*\\AppData\\*", "?:\\Users\\Public\\*", "?:\\ProgramData\\*", "?:\\Windows\\Microsoft.Net\\*") or
   process.name in~ ("wscript.exe", "cscript.exe", "mshta.exe", "powershell.exe", "regsvr32.exe", "rundll32.exe", "cmd.exe")
  ) and
  not (process.code_signature.subject_name :
               ("Cypress.io, Inc.", "PortSwigger Ltd", "Scalehat Technologies Ltd", "Azul Systems, Inc.", "JetBrains s.r.o.",
                "Katalon Inc.", "Shenzhen Love Sense Technology Co., Ltd.") and
       process.code_signature.trusted == true) and

  not process.hash.sha256 :
              ("a064743886dc4068db7e4143a2eba14d1cdf80f5dd28d8057c6087a30ca7f3b4",
               "7d95b4e26859620738a31dbbafbf019da42f2378821e2bb49b748956ef50b3e3",
               "fcc098d6a5df5a302c4fc635203bf28868a92d2469465551f6cf7e5c93a1719a",
               "e4244190024bdd0ffed267b47f897cca054a4762c76b93cb34ae2d7925589956",
               "e309416c7ec1606899e646b54ff8ac15a42925e2cfb8b0cd5d455b208846671f",
               "02901bc79c262a6e0c9f8c62682c9165e50ed0027ff54011de949c3a510bbd60",
               "e309416c7ec1606899e646b54ff8ac15a42925e2cfb8b0cd5d455b208846671f",
               "ffa8aee6d8b251b21d7744980196fb556ca7e4247aa7017d5e7ee7d498d50c4d",
               "02901bc79c262a6e0c9f8c62682c9165e50ed0027ff54011de949c3a510bbd60",
               "976373ee09d6cb298ac802b46002c9dfbd30f1bf0988f840a74285ee409c6d5d",
               "023f1d06be341eb26c365706a9113f9f23087aaf4df6cc17d12ec935a7a1a0cc",
               "839ef38f0ed23a9dcca4f0a807e205f95e26370f35ec9ea9915721c06eda04f2",
               "88e697f93ea94d74a1979af662339e826d784337e0abdb74f27e9293d94e9fed",
               "f7c7a89503959800005bfe6767f189e49c9c76aeea38d6f304f7be2d8663d204",
               "55c5203db4d44d96f4124c60e69ae0823f4372efa4b5416675d9564a83d6ad2c",
               "afb45186ad4f4217c2fc1dfc2239ff5ab016ef0ba5fc329bc6aa8fd10c7ecc88") and

  not (process.name : "cmd.exe" and
       process.parent.executable : ("?:\\Users\\*\\AppData\\Local\\Programs\\GoLogin\\GoLogin.exe",
                                    "C:\\Users\\*\\AppData\\Local\\PDFProSuite\\pdfprosuite.exe")) and

  not (process.executable : "?:\\Windows\\SysWOW64\\cmd.exe" and process.parent.name : "node.exe" and
       process.parent.args : ("--check-update", "update.js"))
  ] by process.entity_id
 [process where event.action == "start" and process.command_line : "*--load-extension*"] by process.parent.entity_id
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1176"
name = "Software Extensions"
reference = "https://attack.mitre.org/techniques/T1176/"
[[threat.technique.subtechnique]]
id = "T1176.001"
name = "Browser Extensions"
reference = "https://attack.mitre.org/techniques/T1176/001/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.4.0"