Chromium Browser Instance Executed With Custom Extension

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Aedan Russell, frack113, X__Junior (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects a Chromium based browser process with the 'load-extension' flag to start a instance with a custom extension

Known false positives

Usage of Chrome Extensions in testing tools such as BurpSuite will trigger this alert

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1176.001` Software Extensions: Browser Extensions

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Chromium Browser Instance Executed With Custom Extension
id: 88d6e60c-759d-4ac1-a447-c0f1466c2d21
related:
    - id: 27ba3207-dd30-4812-abbf-5d20c57d474e
      type: similar
status: test
description: Detects a Chromium based browser process with the 'load-extension' flag to start a instance with a custom extension
references:
    - https://redcanary.com/blog/chromeloader/
    - https://emkc.org/s/RJjuLa
    - https://www.mandiant.com/resources/blog/lnk-between-browsers
author: Aedan Russell, frack113, X__Junior (Nextron Systems)
date: 2022-06-19
modified: 2023-11-28
tags:
    - attack.persistence
    - attack.t1176.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\brave.exe'
            - '\chrome.exe'
            - '\msedge.exe'
            - '\opera.exe'
            - '\vivaldi.exe'
        CommandLine|contains: '--load-extension='
    condition: selection
falsepositives:
    - Usage of Chrome Extensions in testing tools such as BurpSuite will trigger this alert
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_load_extension/info.yml

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|endswith:
        - '\brave.exe'
        - '\chrome.exe'
        - '\msedge.exe'
        - '\opera.exe'
        - '\vivaldi.exe'
    CommandLine|contains: '--load-extension='

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`--load-extension=` corpus 2 (sigma 2)	`field:"CommandLine" kind:match value:"--load-extension="`
`Image`	ends_with	`\brave.exe` corpus 11 (sigma 11) `\chrome.exe` corpus 13 (sigma 13) `\msedge.exe` corpus 14 (sigma 14) `\opera.exe` corpus 11 (sigma 11) `\vivaldi.exe` corpus 11 (sigma 11)	`field:"Image" kind:ends_with`

Chromium Browser Instance Executed With Custom Extension

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Stage 0: `condition`

Stage 1: `selection`