Running Chrome VPN Extensions via the Registry 2 VPN Extension

Status: test
Severity: high
Log source: product windows, category registry_set
Author: frack113
Source: github.com/SigmaHQ/sigma

Running Chrome VPN Extensions via the Registry install 2 vpn extension

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1133` External Remote Services
Persistence	`T1133` External Remote Services

Event coverage

Provider	Event	Title
Sysmon	Event ID 13	RegistryEvent (Value Set)

Rule body yaml

title: Running Chrome VPN Extensions via the Registry 2 VPN Extension
id: b64a026b-8deb-4c1d-92fd-98893209dff1
status: test
description: Running Chrome VPN Extensions via the Registry install 2 vpn extension
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1133/T1133.md#atomic-test-1---running-chrome-vpn-extensions-via-the-registry-2-vpn-extension
author: frack113
date: 2021-12-28
modified: 2023-08-17
tags:
    - attack.initial-access
    - attack.persistence
    - attack.t1133
logsource:
    category: registry_set
    product: windows
detection:
    chrome_ext:
        TargetObject|contains: 'Software\Wow6432Node\Google\Chrome\Extensions'
        TargetObject|endswith: 'update_url'
    chrome_vpn:
        TargetObject|contains:
            - fdcgdnkidjaadafnichfpabhfomcebme # ZenMate VPN
            - fcfhplploccackoneaefokcmbjfbkenj # 1clickVPN
            - bihmplhobchoageeokmgbdihknkjbknd # Touch VPN
            - gkojfkhlekighikafcpjkiklfbnlmeio # Hola Free VPN
            - jajilbjjinjmgcibalaakngmkilboobh # Astar VPN
            - gjknjjomckknofjidppipffbpoekiipm # VPN Free
            - nabbmpekekjknlbkgpodfndbodhijjem # Earth VPN
            - kpiecbcckbofpmkkkdibbllpinceiihk # DotVPN
            - nlbejmccbhkncgokjcmghpfloaajcffj # Hotspot Shield Free VPN
            - omghfjlpggmjjaagoclmmobgdodcjboh # Browsec VPN
            - bibjcjfmgapbfoljiojpipaooddpkpai # VPN-free.pro
            - mpcaainmfjjigeicjnlkdfajbioopjko # VPN Unlimited Free
            - jljopmgdobloagejpohpldgkiellmfnc # PP VPN
            - lochiccbgeohimldjooaakjllnafhaid # IP Unblock
            - nhnfcgpcbfclhfafjlooihdfghaeinfc # Surf VPN
            - ookhnhpkphagefgdiemllfajmkdkcaim # iNinja VPN
            - namfblliamklmeodpcelkokjbffgmeoo # Daily VPN
            - nbcojefnccbanplpoffopkoepjmhgdgh # Hoxx VPN Proxy
            - majdfhpaihoncoakbjgbdhglocklcgno # Free VPN
            - lnfdmdhmfbimhhpaeocncdlhiodoblbd # VPN PROXY MASTER
            - eppiocemhmnlbhjplcgkofciiegomcon # Urban Free VPN
            - cocfojppfigjeefejbpfmedgjbpchcng # SaferVPN Proxy
            - foiopecknacmiihiocgdjgbjokkpkohc # VPN Professional
            - hhdobjgopfphlmjbmnpglhfcgppchgje # AdGuard VPN
            - jgbaghohigdbgbolncodkdlpenhcmcge # Free VPN
            - inligpkjkhbpifecbdjhmdpcfhnlelja # Free One Touch VPN
            - higioemojdadgdbhbbbkfbebbdlfjbip # Unlimited VPN & Proxy by ibVPN
            - hipncndjamdcmphkgngojegjblibadbe # RusVPN
            - iolonopooapdagdemdoaihahlfkncfgg # Azino VPN
            - nhfjkakglbnnpkpldhjmpmmfefifedcj # Pron VPN
            - jpgljfpmoofbmlieejglhonfofmahini # Free Residential VPN
            - fgddmllnllkalaagkghckoinaemmogpe # ExpressVPN
            - ejkaocphofnobjdedneohbbiilggdlbi # Hotspot Shield Elite VPN Proxy
            - keodbianoliadkoelloecbhllnpiocoi # Hide My IP VPN
            - hoapmlpnmpaehilehggglehfdlnoegck # Tunnello VPN
            - poeojclicodamonabcabmapamjkkmnnk # HMA VPN Proxy Unblocker
            - dfkdflfgjdajbhocmfjolpjbebdkcjog # Free Avira Phantom VPN
            - kcdahmgmaagjhocpipbodaokikjkampi # Hola VPN
            - klnkiajpmpkkkgpgbogmcgfjhdoljacg # Free VPN for Chrome
            - lneaocagcijjdpkcabeanfpdbmapcjjg # Hub VPN
            - pgfpignfckbloagkfnamnolkeaecfgfh # Free Proxy VPN
            - jplnlifepflhkbkgonidnobkakhmpnmh # Private Internet Access
            - jliodmnojccaloajphkingdnpljdhdok # Turbo VPN for PC
            - hnmpcagpplmpfojmgmnngilcnanddlhb # Windscribe
            - ffbkglfijbcbgblgflchnbphjdllaogb # CyberGhost VPN
            - kcndmbbelllkmioekdagahekgimemejo # VPN.AC
            - jdgilggpfmjpbodmhndmhojklgfdlhob # Browser VPN
            - bihhflimonbpcfagfadcnbbdngpopnjb # DEEPRISM VPN
            - ppajinakbfocjfnijggfndbdmjggcmde # My Browser Vpn
            - oofgbpoabipfcfjapgnbbjjaenockbdp # SetupVPN
            - bhnhkdgoefpmekcgnccpnhjfdgicfebm # Wachee VPN
            - knmmpciebaoojcpjjoeonlcjacjopcpf # Thunder Proxy
            - dhadilbmmjiooceioladdphemaliiobo # Free Proxy VPN
            - jedieiamjmoflcknjdjhpieklepfglin # FastestVPN Proxy
            - mhngpdlhojliikfknhfaglpnddniijfh # WorkingVPN
            - omdakjcmkglenbhjadbccaookpfjihpa # TunnelBear VPN
            - npgimkapccfidfkfoklhpkgmhgfejhbj # BelkaVPN
            - akeehkgglkmpapdnanoochpfmeghfdln # VPN Master
            - gbmdmipapolaohpinhblmcnpmmlgfgje # Unblock Websites
            - aigmfoeogfnljhnofglledbhhfegannp # Lethean Proxy VPN
            - cgojmfochfikphincbhokimmmjenhhgk # Whoer VPN
            - ficajfeojakddincjafebjmfiefcmanc # Best VPN USA
            - ifnaibldjfdmaipaddffmgcmekjhiloa # FREE VPN DEWELOPMENT
            - jbnmpdkcfkochpanomnkhnafobppmccn # apkfold free vpn
            - apcfdffemoinopelidncddjbhkiblecc # Soul VPN
            - mjolnodfokkkaichkcjipfgblbfgojpa # DotVPN
            - oifjbnnafapeiknapihcmpeodaeblbkn # rderzh VPN Proxy
            - plpmggfglncceinmilojdkiijhmajkjh # Red Panda VPN
            - mjnbclmflcpookeapghfhapeffmpodij # Ultrareach VPN
            - bblcccknbdbplgmdjnnikffefhdlobhp # FastStunnel VPN
            - aojlhgbkmkahabcmcpifbolnoichfeep # VirtualShield VPN
            - lcmammnjlbmlbcaniggmlejfjpjagiia # Adblock Office VPN Proxy Server
            - knajdeaocbpmfghhmijicidfcmdgbdpm # Guru VPN & Proxy
            - bdlcnpceagnkjnjlbbbcepohejbheilk # Malus VPN
            - edknjdjielmpdlnllkdmaghlbpnmjmgb # Muscle VPN
            - eidnihaadmmancegllknfbliaijfmkgo # Push VPN
            - ckiahbcmlmkpfiijecbpflfahoimklke # Gom VPN
            - macdlemfnignjhclfcfichcdhiomgjjb # Free Fast VPN
            - chioafkonnhbpajpengbalkececleldf # BullVPN
            - amnoibeflfphhplmckdbiajkjaoomgnj # HideAll VPN
            - llbhddikeonkpbhpncnhialfbpnilcnc # ProxyFlow
            - pcienlhnoficegnepejpfiklggkioccm # Cloud VPN
            - iocnglnmfkgfedpcemdflhkchokkfeii # sVPN
            - igahhbkcppaollcjeaaoapkijbnphfhb # Social VPN
            - njpmifchgidinihmijhcfpbdmglecdlb # Trellonet Trellonet
            - ggackgngljinccllcmbgnpgpllcjepgc # WindmillVPN
            - kchocjcihdgkoplngjemhpplmmloanja # IPBurger Proxy & VPN
            - bnijmipndnicefcdbhgcjoognndbgkep # Veee
            - lklekjodgannjcccdlbicoamibgbdnmi # Anonymous Proxy Vpn Browser
            - dbdbnchagbkhknegmhgikkleoogjcfge # Hideman VPN
            - egblhcjfjmbjajhjhpmnlekffgaemgfh # Fornex VPN
            - ehbhfpfdkmhcpaehaooegfdflljcnfec # WeVPN
            - bkkgdjpomdnfemhhkalfkogckjdkcjkg # VPNMatic
            - almalgbpmcfpdaopimbdchdliminoign # Urban Shield
            - akkbkhnikoeojlhiiomohpdnkhbkhieh # Prime VPN
            - gbfgfbopcfokdpkdigfmoeaajfmpkbnh # westwind
            - bniikohfmajhdcffljgfeiklcbgffppl # Upnet
            - lejgfmmlngaigdmmikblappdafcmkndb # uVPN
            - ffhhkmlgedgcliajaedapkdfigdobcif # Nucleus VPN
            - gcknhkkoolaabfmlnjonogaaifnjlfnp # FoxyProxy Standard
            - pooljnboifbodgifngpppfklhifechoe # GeoProxy
            - fjoaledfpmneenckfbpdfhkmimnjocfa # NordVPN
            - aakchaleigkohafkfjfjbblobjifikek # ProxFlow
            - dpplabbmogkhghncfbfdeeokoefdjegm # Proxy SwitchySharp
            - padekgcemlokbadohgkifijomclgjgif # Proxy SwitchyOmega
            - bfidboloedlamgdmenmlbipfnccokknp # PureVPN
    condition: all of chrome_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

all of chrome_*

Stage 1: `chrome_ext`

chrome_ext:
    TargetObject|contains: 'Software\Wow6432Node\Google\Chrome\Extensions'
    TargetObject|endswith: 'update_url'

Stage 2: `chrome_vpn`

chrome_vpn:
    TargetObject|contains:
        - fdcgdnkidjaadafnichfpabhfomcebme
        - fcfhplploccackoneaefokcmbjfbkenj
        - bihmplhobchoageeokmgbdihknkjbknd
        - gkojfkhlekighikafcpjkiklfbnlmeio
        - jajilbjjinjmgcibalaakngmkilboobh
        - gjknjjomckknofjidppipffbpoekiipm
        - nabbmpekekjknlbkgpodfndbodhijjem
        - kpiecbcckbofpmkkkdibbllpinceiihk
        - nlbejmccbhkncgokjcmghpfloaajcffj
        - omghfjlpggmjjaagoclmmobgdodcjboh
        - bibjcjfmgapbfoljiojpipaooddpkpai
        - mpcaainmfjjigeicjnlkdfajbioopjko
        - jljopmgdobloagejpohpldgkiellmfnc
        - lochiccbgeohimldjooaakjllnafhaid
        - nhnfcgpcbfclhfafjlooihdfghaeinfc
        - ookhnhpkphagefgdiemllfajmkdkcaim
        - namfblliamklmeodpcelkokjbffgmeoo
        - nbcojefnccbanplpoffopkoepjmhgdgh
        - majdfhpaihoncoakbjgbdhglocklcgno
        - lnfdmdhmfbimhhpaeocncdlhiodoblbd
        - eppiocemhmnlbhjplcgkofciiegomcon
        - cocfojppfigjeefejbpfmedgjbpchcng
        - foiopecknacmiihiocgdjgbjokkpkohc
        - hhdobjgopfphlmjbmnpglhfcgppchgje
        - jgbaghohigdbgbolncodkdlpenhcmcge
        - inligpkjkhbpifecbdjhmdpcfhnlelja
        - higioemojdadgdbhbbbkfbebbdlfjbip
        - hipncndjamdcmphkgngojegjblibadbe
        - iolonopooapdagdemdoaihahlfkncfgg
        - nhfjkakglbnnpkpldhjmpmmfefifedcj
        - jpgljfpmoofbmlieejglhonfofmahini
        - fgddmllnllkalaagkghckoinaemmogpe
        - ejkaocphofnobjdedneohbbiilggdlbi
        - keodbianoliadkoelloecbhllnpiocoi
        - hoapmlpnmpaehilehggglehfdlnoegck
        - poeojclicodamonabcabmapamjkkmnnk
        - dfkdflfgjdajbhocmfjolpjbebdkcjog
        - kcdahmgmaagjhocpipbodaokikjkampi
        - klnkiajpmpkkkgpgbogmcgfjhdoljacg
        - lneaocagcijjdpkcabeanfpdbmapcjjg
        - pgfpignfckbloagkfnamnolkeaecfgfh
        - jplnlifepflhkbkgonidnobkakhmpnmh
        - jliodmnojccaloajphkingdnpljdhdok
        - hnmpcagpplmpfojmgmnngilcnanddlhb
        - ffbkglfijbcbgblgflchnbphjdllaogb
        - kcndmbbelllkmioekdagahekgimemejo
        - jdgilggpfmjpbodmhndmhojklgfdlhob
        - bihhflimonbpcfagfadcnbbdngpopnjb
        - ppajinakbfocjfnijggfndbdmjggcmde
        - oofgbpoabipfcfjapgnbbjjaenockbdp
        - bhnhkdgoefpmekcgnccpnhjfdgicfebm
        - knmmpciebaoojcpjjoeonlcjacjopcpf
        - dhadilbmmjiooceioladdphemaliiobo
        - jedieiamjmoflcknjdjhpieklepfglin
        - mhngpdlhojliikfknhfaglpnddniijfh
        - omdakjcmkglenbhjadbccaookpfjihpa
        - npgimkapccfidfkfoklhpkgmhgfejhbj
        - akeehkgglkmpapdnanoochpfmeghfdln
        - gbmdmipapolaohpinhblmcnpmmlgfgje
        - aigmfoeogfnljhnofglledbhhfegannp
        - cgojmfochfikphincbhokimmmjenhhgk
        - ficajfeojakddincjafebjmfiefcmanc
        - ifnaibldjfdmaipaddffmgcmekjhiloa
        - jbnmpdkcfkochpanomnkhnafobppmccn
        - apcfdffemoinopelidncddjbhkiblecc
        - mjolnodfokkkaichkcjipfgblbfgojpa
        - oifjbnnafapeiknapihcmpeodaeblbkn
        - plpmggfglncceinmilojdkiijhmajkjh
        - mjnbclmflcpookeapghfhapeffmpodij
        - bblcccknbdbplgmdjnnikffefhdlobhp
        - aojlhgbkmkahabcmcpifbolnoichfeep
        - lcmammnjlbmlbcaniggmlejfjpjagiia
        - knajdeaocbpmfghhmijicidfcmdgbdpm
        - bdlcnpceagnkjnjlbbbcepohejbheilk
        - edknjdjielmpdlnllkdmaghlbpnmjmgb
        - eidnihaadmmancegllknfbliaijfmkgo
        - ckiahbcmlmkpfiijecbpflfahoimklke
        - macdlemfnignjhclfcfichcdhiomgjjb
        - chioafkonnhbpajpengbalkececleldf
        - amnoibeflfphhplmckdbiajkjaoomgnj
        - llbhddikeonkpbhpncnhialfbpnilcnc
        - pcienlhnoficegnepejpfiklggkioccm
        - iocnglnmfkgfedpcemdflhkchokkfeii
        - igahhbkcppaollcjeaaoapkijbnphfhb
        - njpmifchgidinihmijhcfpbdmglecdlb
        - ggackgngljinccllcmbgnpgpllcjepgc
        - kchocjcihdgkoplngjemhpplmmloanja
        - bnijmipndnicefcdbhgcjoognndbgkep
        - lklekjodgannjcccdlbicoamibgbdnmi
        - dbdbnchagbkhknegmhgikkleoogjcfge
        - egblhcjfjmbjajhjhpmnlekffgaemgfh
        - ehbhfpfdkmhcpaehaooegfdflljcnfec
        - bkkgdjpomdnfemhhkalfkogckjdkcjkg
        - almalgbpmcfpdaopimbdchdliminoign
        - akkbkhnikoeojlhiiomohpdnkhbkhieh
        - gbfgfbopcfokdpkdigfmoeaajfmpkbnh
        - bniikohfmajhdcffljgfeiklcbgffppl
        - lejgfmmlngaigdmmikblappdafcmkndb
        - ffhhkmlgedgcliajaedapkdfigdobcif
        - gcknhkkoolaabfmlnjonogaaifnjlfnp
        - pooljnboifbodgifngpppfklhifechoe
        - fjoaledfpmneenckfbpdfhkmimnjocfa
        - aakchaleigkohafkfjfjbblobjifikek
        - dpplabbmogkhghncfbfdeeokoefdjegm
        - padekgcemlokbadohgkifijomclgjgif
        - bfidboloedlamgdmenmlbipfnccokknp

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`TargetObject`	ends_with	`update_url`
`TargetObject`	match	`Software\Wow6432Node\Google\Chrome\Extensions` `aakchaleigkohafkfjfjbblobjifikek` `aigmfoeogfnljhnofglledbhhfegannp` `akeehkgglkmpapdnanoochpfmeghfdln` `akkbkhnikoeojlhiiomohpdnkhbkhieh` `almalgbpmcfpdaopimbdchdliminoign` `amnoibeflfphhplmckdbiajkjaoomgnj` `aojlhgbkmkahabcmcpifbolnoichfeep` `apcfdffemoinopelidncddjbhkiblecc` `bblcccknbdbplgmdjnnikffefhdlobhp` `bdlcnpceagnkjnjlbbbcepohejbheilk` `bfidboloedlamgdmenmlbipfnccokknp` `bhnhkdgoefpmekcgnccpnhjfdgicfebm` `bibjcjfmgapbfoljiojpipaooddpkpai` `bihhflimonbpcfagfadcnbbdngpopnjb` `bihmplhobchoageeokmgbdihknkjbknd` `bkkgdjpomdnfemhhkalfkogckjdkcjkg` `bniikohfmajhdcffljgfeiklcbgffppl` `bnijmipndnicefcdbhgcjoognndbgkep` `cgojmfochfikphincbhokimmmjenhhgk` `chioafkonnhbpajpengbalkececleldf` `ckiahbcmlmkpfiijecbpflfahoimklke` `cocfojppfigjeefejbpfmedgjbpchcng` `dbdbnchagbkhknegmhgikkleoogjcfge` `dfkdflfgjdajbhocmfjolpjbebdkcjog` `dhadilbmmjiooceioladdphemaliiobo` `dpplabbmogkhghncfbfdeeokoefdjegm` `edknjdjielmpdlnllkdmaghlbpnmjmgb` `egblhcjfjmbjajhjhpmnlekffgaemgfh` `ehbhfpfdkmhcpaehaooegfdflljcnfec` `eidnihaadmmancegllknfbliaijfmkgo` `ejkaocphofnobjdedneohbbiilggdlbi` `eppiocemhmnlbhjplcgkofciiegomcon` `fcfhplploccackoneaefokcmbjfbkenj` `fdcgdnkidjaadafnichfpabhfomcebme` `ffbkglfijbcbgblgflchnbphjdllaogb` `ffhhkmlgedgcliajaedapkdfigdobcif` `fgddmllnllkalaagkghckoinaemmogpe` `ficajfeojakddincjafebjmfiefcmanc` `fjoaledfpmneenckfbpdfhkmimnjocfa` `foiopecknacmiihiocgdjgbjokkpkohc` `gbfgfbopcfokdpkdigfmoeaajfmpkbnh` `gbmdmipapolaohpinhblmcnpmmlgfgje` `gcknhkkoolaabfmlnjonogaaifnjlfnp` `ggackgngljinccllcmbgnpgpllcjepgc` `gjknjjomckknofjidppipffbpoekiipm` `gkojfkhlekighikafcpjkiklfbnlmeio` `hhdobjgopfphlmjbmnpglhfcgppchgje` `higioemojdadgdbhbbbkfbebbdlfjbip` `hipncndjamdcmphkgngojegjblibadbe` `hnmpcagpplmpfojmgmnngilcnanddlhb` `hoapmlpnmpaehilehggglehfdlnoegck` `ifnaibldjfdmaipaddffmgcmekjhiloa` `igahhbkcppaollcjeaaoapkijbnphfhb` `inligpkjkhbpifecbdjhmdpcfhnlelja` `iocnglnmfkgfedpcemdflhkchokkfeii` `iolonopooapdagdemdoaihahlfkncfgg` `jajilbjjinjmgcibalaakngmkilboobh` `jbnmpdkcfkochpanomnkhnafobppmccn` `jdgilggpfmjpbodmhndmhojklgfdlhob` `jedieiamjmoflcknjdjhpieklepfglin` `jgbaghohigdbgbolncodkdlpenhcmcge` `jliodmnojccaloajphkingdnpljdhdok` `jljopmgdobloagejpohpldgkiellmfnc` `jpgljfpmoofbmlieejglhonfofmahini` `jplnlifepflhkbkgonidnobkakhmpnmh` `kcdahmgmaagjhocpipbodaokikjkampi` `kchocjcihdgkoplngjemhpplmmloanja` `kcndmbbelllkmioekdagahekgimemejo` `keodbianoliadkoelloecbhllnpiocoi` `klnkiajpmpkkkgpgbogmcgfjhdoljacg` `knajdeaocbpmfghhmijicidfcmdgbdpm` `knmmpciebaoojcpjjoeonlcjacjopcpf` `kpiecbcckbofpmkkkdibbllpinceiihk` `lcmammnjlbmlbcaniggmlejfjpjagiia` `lejgfmmlngaigdmmikblappdafcmkndb` `lklekjodgannjcccdlbicoamibgbdnmi` `llbhddikeonkpbhpncnhialfbpnilcnc` `lneaocagcijjdpkcabeanfpdbmapcjjg` `lnfdmdhmfbimhhpaeocncdlhiodoblbd` `lochiccbgeohimldjooaakjllnafhaid` `macdlemfnignjhclfcfichcdhiomgjjb` `majdfhpaihoncoakbjgbdhglocklcgno` `mhngpdlhojliikfknhfaglpnddniijfh` `mjnbclmflcpookeapghfhapeffmpodij` `mjolnodfokkkaichkcjipfgblbfgojpa` `mpcaainmfjjigeicjnlkdfajbioopjko` `nabbmpekekjknlbkgpodfndbodhijjem` `namfblliamklmeodpcelkokjbffgmeoo` `nbcojefnccbanplpoffopkoepjmhgdgh` `nhfjkakglbnnpkpldhjmpmmfefifedcj` `nhnfcgpcbfclhfafjlooihdfghaeinfc` `njpmifchgidinihmijhcfpbdmglecdlb` `nlbejmccbhkncgokjcmghpfloaajcffj` `npgimkapccfidfkfoklhpkgmhgfejhbj` `oifjbnnafapeiknapihcmpeodaeblbkn` `omdakjcmkglenbhjadbccaookpfjihpa` `omghfjlpggmjjaagoclmmobgdodcjboh` `oofgbpoabipfcfjapgnbbjjaenockbdp` `ookhnhpkphagefgdiemllfajmkdkcaim` `padekgcemlokbadohgkifijomclgjgif` `pcienlhnoficegnepejpfiklggkioccm` `pgfpignfckbloagkfnamnolkeaecfgfh` `plpmggfglncceinmilojdkiijhmajkjh` `poeojclicodamonabcabmapamjkkmnnk` `pooljnboifbodgifngpppfklhifechoe` `ppajinakbfocjfnijggfndbdmjggcmde`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Running Chrome VPN Extensions via the Registry 2 VPN Extension

MITRE ATT&CK coverage

Event coverage

Rule body yaml

Stages and Predicates

Stage 0: `condition`

Stage 1: `chrome_ext`

Stage 2: `chrome_vpn`

Indicators

Keyboard shortcuts

Search operators

Running Chrome VPN Extensions via the Registry 2 VPN Extension

MITRE ATT&CK coverage

Event coverage

Rule body yaml

Stages and Predicates

Stage 0: condition

Stage 1: chrome_ext

Stage 2: chrome_vpn

Indicators

Stage 0: `condition`

Stage 1: `chrome_ext`

Stage 2: `chrome_vpn`