detection.wiki

Detection rules › Kusto

Hunt for compromised browser extensions

Group by
DeviceId, ExtensionId, Id
Author
Robbe Van den Daele
Source
github.com/HybridBrothers/Hunting-Queries-Detection-Rules

This hunting rule can be used to find devices using known compromised browser extensions. It is created based on the threat researched linked in the reference section.

MITRE ATT&CK coverage

TacticTechniques
Persistence

References

Telemetry coverage

PlatformRecord / event type
Microsoft Defender for EndpointDeviceInfo action any: Device information

Rule body

let extensions = datatable (Id:string, VulnVersion:string) [
    "nnpnnpemnckcfdebeekibpiijlicmpom", "2.0.1",
    "kkodiihpgodmdankclfibbiphjkfdenh", "1.16.2",
    "oaikpkmjciadfpddlpjjdapglcihgdle", "1.0.12",
    "dpggmcodlahmljkhlmpgpdcffdaoccni", "1.1.1",
    "acmfnomgphggonodopogfbmkneepfgnh", "4.00",
    "mnhffkhmpnefgklngfmlndmkimimbphc", "4.40",
    "cedgndijpacnfbdggppddacngjfdkaca", "0.0.11",
    "bbdnohkpnbkdkmnkddobeafboooinpla", "1.0.1",
    "egmennebgadmncfjafcemlecimkepcle", "2.2.7",
    "bibjgkidgpfbblifamdlkdlhgihmfohh", "0.1.3",
    "befflofjcniongenjmbkgkoljhgliihe", "2.13.0",
    "pkgciiiancapdlpcbppfkmeaieppikkk", "1.3.7",
    "llimhhconnjiflfimocjggfjdlmlhblm", "1.5.7",
    "oeiomhmbaapihbilkfkhmlajkeegnjhe", "3.18.0",
    "pajkjnmeojmbapicmbpliphjmcekeaac", "24.10.4",
    "ndlbedplllcgconngcnfmkadhokfaaln", "2.22.6",
    "epdjhgbipjpbbhoccdeipghoihibnfja", "1.4",
    "cplhlgabfijoiabgkigdafklbhhdkahj", "1.0.161",
    "jiofmdifioeejeilfkpegipdjiopiekl", "1.1.61",
    "hihblcmlaaademjlakdpicchbjnnnkbo", "3.0.2",
    "llimhhconnjiflfimocjggfjdlmlhblm", "1.5.7",
    "ekpkdmohpdnebfedjjfklhpefgpgaaji", "1.3",
    "epikoohpebngmakjinphfiagogjcnddm", "2.7.3",
    "miglaibdlgminlepgeifekifakochlka", "1.4.5",
    "eanofdhdfbcalhflpbdipkjjkoimeeod", "1.4.9",
    "ogbhbgkiojdollpjbhbamafmedkeockb", "1.8.1",
    "bgejafhieobnfpjlpcjjggoboebonfcg", "1.1.1",
    "igbodamhgjohafcenbcljfegbipdfjpk", "2.3",
    "mbindhfolmpijhodmgkloeeppmkhpmhc", "1.44",
    "hodiladlefdpcbemnbbcpclbmknkiaem", "3.1.3",
    "lbneaaedflankmgmfbmaplggbmjjmbae", "1.3.8",
    "eaijffijbobmnonfhilihbejadplhddo", "2.4",
    "hmiaoahjllhfgebflooeeefeiafpkfde", "1.0.0"
];
DeviceTvmBrowserExtensions
// Find devices using vulnerable extensions
| join kind=inner extensions on $left.ExtensionId == $right.Id
| extend IntVersion = parse_version(ExtensionVersion), IntVulnVursion = parse_version(VulnVersion)
| where IntVersion <= IntVulnVursion and IsActivated == "true"
// Join for more device info
| join kind=inner (
    DeviceInfo 
    | where Timestamp > ago(7d)
) on DeviceId
| distinct DeviceName, DeviceId, BrowserName, ExtensionName, ExtensionDescription, ExtensionVersion, ExtensionRisk, VulnVersion

Stages and Predicates

Let binding: extensions used in Stage 2

let extensions = datatable (Id:string, VulnVersion:string) [
    "nnpnnpemnckcfdebeekibpiijlicmpom", "2.0.1",
    "kkodiihpgodmdankclfibbiphjkfdenh", "1.16.2",
    "oaikpkmjciadfpddlpjjdapglcihgdle", "1.0.12",
    "dpggmcodlahmljkhlmpgpdcffdaoccni", "1.1.1",
    "acmfnomgphggonodopogfbmkneepfgnh", "4.00",
    "mnhffkhmpnefgklngfmlndmkimimbphc", "4.40",
    "cedgndijpacnfbdggppddacngjfdkaca", "0.0.11",
    "bbdnohkpnbkdkmnkddobeafboooinpla", "1.0.1",
    "egmennebgadmncfjafcemlecimkepcle", "2.2.7",
    "bibjgkidgpfbblifamdlkdlhgihmfohh", "0.1.3",
    "befflofjcniongenjmbkgkoljhgliihe", "2.13.0",
    "pkgciiiancapdlpcbppfkmeaieppikkk", "1.3.7",
    "llimhhconnjiflfimocjggfjdlmlhblm", "1.5.7",
    "oeiomhmbaapihbilkfkhmlajkeegnjhe", "3.18.0",
    "pajkjnmeojmbapicmbpliphjmcekeaac", "24.10.4",
    "ndlbedplllcgconngcnfmkadhokfaaln", "2.22.6",
    "epdjhgbipjpbbhoccdeipghoihibnfja", "1.4",
    "cplhlgabfijoiabgkigdafklbhhdkahj", "1.0.161",
    "jiofmdifioeejeilfkpegipdjiopiekl", "1.1.61",
    "hihblcmlaaademjlakdpicchbjnnnkbo", "3.0.2",
    "llimhhconnjiflfimocjggfjdlmlhblm", "1.5.7",
    "ekpkdmohpdnebfedjjfklhpefgpgaaji", "1.3",
    "epikoohpebngmakjinphfiagogjcnddm", "2.7.3",
    "miglaibdlgminlepgeifekifakochlka", "1.4.5",
    "eanofdhdfbcalhflpbdipkjjkoimeeod", "1.4.9",
    "ogbhbgkiojdollpjbhbamafmedkeockb", "1.8.1",
    "bgejafhieobnfpjlpcjjggoboebonfcg", "1.1.1",
    "igbodamhgjohafcenbcljfegbipdfjpk", "2.3",
    "mbindhfolmpijhodmgkloeeppmkhpmhc", "1.44",
    "hodiladlefdpcbemnbbcpclbmknkiaem", "3.1.3",
    "lbneaaedflankmgmfbmaplggbmjjmbae", "1.3.8",
    "eaijffijbobmnonfhilihbejadplhddo", "2.4",
    "hmiaoahjllhfgebflooeeefeiafpkfde", "1.0.0"
];

Stage 1: source

DeviceTvmBrowserExtensions

Stage 2: join

| join kind=inner extensions on $left.ExtensionId == $right.Id

Stage 3: extend

| extend IntVersion = parse_version(ExtensionVersion), IntVulnVursion = parse_version(VulnVersion)

Stage 4: where

| where IntVersion <= IntVulnVursion and IsActivated == "true"

Stage 5: join

| join kind=inner (
    DeviceInfo 
    | where Timestamp > ago(7d)
) on DeviceId

Stage 6: distinct

| distinct DeviceName, DeviceId, BrowserName, ExtensionName, ExtensionDescription, ExtensionVersion, ExtensionRisk, VulnVersion

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
IntVersioncross_field_compare
  • IntVulnVursion transforms: op:le
field:"IntVersion" kind:cross_field_compare value:"IntVulnVursion"
IsActivatedeq
  • true
field:"IsActivated" kind:eq value:"true"

Output fields

These fields are emitted when the rule matches.

FieldSource
IntVersionextend
IntVulnVursionextend