ChromeLoader Malware Execution

Status: test
Severity: high
Log source: category process_creation, product windows
Author: @kostastsale
Source: github.com/SigmaHQ/sigma

Detects execution of ChromeLoader malware via a registered scheduled task

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1053.005` Scheduled Task/Job: Scheduled Task `T1059.001` Command and Scripting Interpreter: PowerShell
Persistence	`T1053.005` Scheduled Task/Job: Scheduled Task `T1176` Software Extensions
Privilege Escalation	`T1053.005` Scheduled Task/Job: Scheduled Task

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: ChromeLoader Malware Execution
id: 0a74c5a9-1b71-4475-9af2-7829d320d5c2
status: test
description: Detects execution of ChromeLoader malware via a registered scheduled task
references:
    - https://github.com/xephora/Threat-Remediation-Scripts/tree/main/Threat-Track/CS_INSTALLER
    - https://twitter.com/th3_protoCOL/status/1480621526764322817
    - https://twitter.com/Kostastsale/status/1480716528421011458
    - https://www.virustotal.com/gui/file/ded20df574b843aaa3c8e977c2040e1498ae17c12924a19868df5b12dee6dfdd
author: '@kostastsale'
date: 2022-01-10
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.t1053.005
    - attack.t1059.001
    - attack.t1176
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\powershell.exe'
        ParentCommandLine|contains: '-ExecutionPolicy Bypass -WindowStyle Hidden -E JAB'
        CommandLine|contains: '--load-extension="*\Appdata\local\chrome"'
        Image|endswith: '\chrome.exe'
    condition: selection
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    ParentImage|endswith: '\powershell.exe'
    ParentCommandLine|contains: '-ExecutionPolicy Bypass -WindowStyle Hidden -E JAB'
    CommandLine|contains: '--load-extension="*\Appdata\local\chrome"'
    Image|endswith: '\chrome.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`--load-extension="*\Appdata\local\chrome"`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\chrome.exe` corpus 13 (sigma 13)	`field:"Image" kind:ends_with value:"\chrome.exe"`
`ParentCommandLine`	match	`-ExecutionPolicy Bypass -WindowStyle Hidden -E JAB`	`field:"ParentCommandLine" kind:match value:"-ExecutionPolicy Bypass -WindowStyle Hidden -E JAB"`
`ParentImage`	ends_with	`\powershell.exe` corpus 24 (sigma 24)	`field:"ParentImage" kind:ends_with value:"\powershell.exe"`

ChromeLoader Malware Execution

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Stage 0: `condition`

Stage 1: `selection`