detection.wiki

Detection rules › Sigma

ChromeLoader Malware Execution

Status
test
Severity
high
Log source
product windows, category process_creation
Author
@kostastsale
Source
github.com/SigmaHQ/sigma

Detects execution of ChromeLoader malware via a registered scheduled task

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1053.005 Scheduled Task/Job: Scheduled Task, T1059.001 Command and Scripting Interpreter: PowerShell
PersistenceT1053.005 Scheduled Task/Job: Scheduled Task, T1176 Software Extensions
Privilege EscalationT1053.005 Scheduled Task/Job: Scheduled Task

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: ChromeLoader Malware Execution
id: 0a74c5a9-1b71-4475-9af2-7829d320d5c2
status: test
description: Detects execution of ChromeLoader malware via a registered scheduled task
references:
    - https://github.com/xephora/Threat-Remediation-Scripts/tree/main/Threat-Track/CS_INSTALLER
    - https://twitter.com/th3_protoCOL/status/1480621526764322817
    - https://twitter.com/Kostastsale/status/1480716528421011458
    - https://www.virustotal.com/gui/file/ded20df574b843aaa3c8e977c2040e1498ae17c12924a19868df5b12dee6dfdd
author: '@kostastsale'
date: 2022-01-10
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.t1053.005
    - attack.t1059.001
    - attack.t1176
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\powershell.exe'
        ParentCommandLine|contains: '-ExecutionPolicy Bypass -WindowStyle Hidden -E JAB'
        CommandLine|contains: '--load-extension="*\Appdata\local\chrome"'
        Image|endswith: '\chrome.exe'
    condition: selection
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    ParentImage|endswith: '\powershell.exe'
    ParentCommandLine|contains: '-ExecutionPolicy Bypass -WindowStyle Hidden -E JAB'
    CommandLine|contains: '--load-extension="*\Appdata\local\chrome"'
    Image|endswith: '\chrome.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • --load-extension="*\Appdata\local\chrome"
Imageends_with
  • \chrome.exe corpus 13 (sigma 13)
ParentCommandLinematch
  • -ExecutionPolicy Bypass -WindowStyle Hidden -E JAB
ParentImageends_with
  • \powershell.exe corpus 24 (sigma 24)