Suspicious Browser Files Modification

[rule]
description = """
Identifies the modification of commonly used browsers settings via file or registry change. Adversaries may install a
rogue browser extension or disable certain browser hardening settings to maintain persistence or evade restrictions.
"""
id = "7df7fca3-8a91-4a54-9799-0478a90ae326"
license = "Elastic License v2"
name = "Suspicious Browser Files Modification"
os_list = ["windows"]
version = "1.0.28"

query = '''
any where event.category in ("file", "registry") and not event.action in ("deletion", "query") and
   (process.code_signature.trusted == false or process.code_signature.exists == false) and
   not user.id in ("S-1-5-18", "S-1-5-19") and
   not process.code_signature.status == "errorExpired" and
   not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*", "E:\\Migwiz\\migwiz.exe") and
   (
     registry.path  : "HK*SOFTWARE\\Policies\\*\\ExtensionInstallWhitelist*" or

	 file.path :
	        ("?:\\Users\\*\\AppData\\Roaming\\Mozilla\\*\\Profiles\\*default*\\extensions.json",
	         "?:\\Users\\*\\AppData\\Roaming\\Mozilla\\*\\Profiles\\*default*\\prefs.js",
	         "?:\\Users\\*\\AppData\\Local\\*\\User Data\\Default\\Extensions\\*.js")
	) and
	not file.Ext.header_bytes : "2f2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a" and
	not (process.code_signature.subject_name == "WAVESOR SOFTWARE" and process.code_signature.status ==  "errorChaining" and
	     process.executable : "?:\\Users\\*\\Wavesor Software\\WaveBrowser\\wavebrowser.exe") and
	process.thread.Ext.call_stack_summary != "ntdll.dll|kernelbase.dll|libcef.dll|kernel32.dll|ntdll.dll"
'''

min_endpoint_version = "8.7.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1176"
name = "Software Extensions"
reference = "https://attack.mitre.org/techniques/T1176/"
[[threat.technique.subtechnique]]
id = "T1176.001"
name = "Browser Extensions"
reference = "https://attack.mitre.org/techniques/T1176/001/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.7.0"