Silent Enabling of Chrome DevTools Protocol

Author: Cyb3rMonk
Source: github.com/Cyb3r-Monk/Threat-Hunting-and-Detection

CDP-Enable-BOF enables Chrome DevTools Protocol by injecting code into the main browser process that hasn't started with the --remote-debugging-port. This enables access to the current user's cookies and credential data without triggering any EDR detections that often monitors the --remote-debugging-port command line parameter.
The query below detects when a Chrome/Edge process that doesn't have the --remote-debugging-port parameter in its command line creates a listening port (remote debugging port). This behavior is normal when chromedriver/msedgedriver starts Chrome/Edge (used in automation workflows).

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	No specific technique

References

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceNetworkEvents` action `ListeningConnectionCreated`: Listening connection created

Rule body

// Description: detects when a Chrome/Edge process that doesn't have the `--remote-debugging-port` parameter in its command line creates a listening port (remote debugging port)
// Author: Cyb3rMonk(https://twitter.com/Cyb3rMonk, https://academy.bluraven.io)
//
// Query Parameters
DeviceNetworkEvents
| where ActionType == "ListeningConnectionCreated"
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe") and InitiatingProcessCommandLine !has "--remote-debugging-port"
| where InitiatingProcessParentFileName !in~ ("chromedriver.exe", "msedgedriver.exe")

Stages and Predicates

Stage 1: `source`

DeviceNetworkEvents

Stage 2: `where`

| where ActionType == "ListeningConnectionCreated"

Stage 3: `where`

| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe") and InitiatingProcessCommandLine !has "--remote-debugging-port"

Stage 4: `where`

| where InitiatingProcessParentFileName !in~ ("chromedriver.exe", "msedgedriver.exe")

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`InitiatingProcessCommandLine`	match	`--remote-debugging-port`	`excludes:InitiatingProcessCommandLine` `field:"InitiatingProcessCommandLine" value:"--remote-debugging-port"`
`InitiatingProcessParentFileName`	in	`chromedriver.exe`, `msedgedriver.exe`	`excludes:InitiatingProcessParentFileName` `field:"InitiatingProcessParentFileName" value:"chromedriver.exe"` `field:"InitiatingProcessParentFileName" value:"msedgedriver.exe"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ActionType`	eq	`ListeningConnectionCreated`	`field:"ActionType" kind:eq value:"ListeningConnectionCreated"`
`InitiatingProcessFileName`	in	`chrome.exe` `msedge.exe`	`field:"parent_process_name" kind:in`