browser_hijack

detections/endpoint/windows_chrome_auto_update_disabled_via_registry.yml

@@ -0,0 +1,72 @@
+name: Windows Chrome Auto-Update Disabled via Registry
+id: 619eac6c-0f03-4699-ae29-5f337877bcf9
+version: 1
+date: '2025-12-17'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+description: The following analytic detects modifications to Windows registry keys that disable Google Chrome auto-updates. Changes to keys such as DisableAutoUpdateChecksCheckboxValue = 1, Update{8A69D345-D564-463C-AFF1-A69D9E530F96} = 0, UpdateDefault = 0, and AutoUpdateCheckPeriodMinutes = 0 can prevent Chrome from receiving security updates. This behavior may indicate attempts to bypass update policies, maintain unauthorized extensions, or facilitate malware persistence. Monitoring these registry changes helps identify potential policy violations or malicious activity targeting browser security.
+data_source:
+- Sysmon EventID 13
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
+
+  where Registry.registry_path = "*\\Google\\Update*" AND
+        (Registry.registry_value_name = "DisableAutoUpdateChecksCheckboxValue" AND Registry.registry_value_data = 0x00000001) OR
+        (Registry.registry_value_name = "Update{8A69D345-D564-463C-AFF1-A69D9E530F96}" AND Registry.registry_value_data = 0x00000000) OR
+        (Registry.registry_value_name = "UpdateDefault" AND Registry.registry_value_data = 0x00000000) OR
+        (Registry.registry_value_name = "AutoUpdateCheckPeriodMinutes" AND Registry.registry_value_data = 0x00000000) 
+
+  by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path 
+     Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name
+     Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
+
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_chrome_auto_update_disabled_via_registry_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the registry value name, registry path, and registry value data from your
+  endpoints. If you are using Sysmon, you must have at least version 2.0 of the official
+  Sysmon TA. https://splunkbase.splunk.com/app/5709
+known_false_positives: IT administrators intentionally disabling auto-updates in managed environments for testing, compatibility, or deployment purposes.
+references:
+- https://www.gdatasoftware.com/blog/2025/11/38298-learning-about-browser-hijacking
+drilldown_searches:
+  - name: View the detection results for - "$dest$"
+    search: '%original_detection_search% | search  dest = "$dest$"'
+    earliest_offset: $info_min_time$
+    latest_offset: $info_max_time$
+  - name: View risk events for the last 7 days for - "$dest$"
+    search:
+      '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
+      starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime
+      values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
+      as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
+      as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
+      | `security_content_ctime(lastTime)`'
+    earliest_offset: $info_min_time$
+    latest_offset: $info_max_time$
+rba:
+  message: Chrome Auto-update in $registry_path$ was disabled on $dest$
+  risk_objects:
+  - field: dest
+    type: system
+    score: 20
+  threat_objects: []
+tags:
+  analytic_story:
+  - Browser Hijacking
+  asset_type: Endpoint
+  mitre_attack_id:
+  - T1185
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/disable_chrome_update/disable_chrome_update.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog

detections/endpoint/windows_chrome_enable_extension_loading_via_command_line.yml

@@ -0,0 +1,71 @@
+name: Windows Chrome Enable Extension Loading via Command-Line
+id: da355155-1d23-48f9-bf95-e534ae273ab0
+version: 1
+date: '2025-12-17'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+description: The following analytic detects instances where Google Chrome is started with the --disable-features=DisableLoadExtensionCommandLineSwitch flag, effectively enabling the loading of extensions via the command line. This may indicate attempts to bypass enterprise extension policies, load unauthorized or malicious extensions, or manipulate browser behavior. Monitoring this activity helps identify potential security policy violations, malware persistence techniques, or other suspicious Chrome modifications.
+data_source:
+- Sysmon EventID 1
+- Windows Event Log Security 4688
+- CrowdStrike ProcessRollup2
+search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where  Processes.process_name = "Chrome.exe" Processes.process= "*--disable-features=DisableLoadExtensionCommandLineSwitch*"
+  by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
+  Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
+  Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
+  Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
+  Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_chrome_enable_extension_loading_via_command_line_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Developers or IT admins loading unpacked extensions for testing or deployment purposes.
+references:
+- https://www.gdatasoftware.com/blog/2025/11/38298-learning-about-browser-hijacking
+drilldown_searches:
+- name: View the detection results for - "$user$" and "$dest$"
+  search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$user$" and "$dest$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
+    "$dest$") starthoursago=168  | stats count min(_time) as firstTime max(_time)
+    as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
+    Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
+    as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
+    by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: a chrome.exe process commandline $process$ that enable browser extension loading in commandline on $dest$.
+  risk_objects:
+  - field: dest
+    type: system
+    score: 30
+  threat_objects:
+  - field: parent_process_name
+    type: parent_process_name
+tags:
+  analytic_story:
+  - Browser Hijacking
+  asset_type: Endpoint
+  mitre_attack_id:
+  - T1185
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/chrome_load_extensions/chrome_load_extension.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog

detections/endpoint/windows_chrome_extension_allowed_registry_modification.yml

@@ -0,0 +1,65 @@
+name: 'Windows Chrome Extension Allowed Registry Modification'
+id: 2846089a-ffe9-4881-a2a2-43f3be2b8cc7
+version: 1
+date: '2025-12-17'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+description: The following analytic detects modifications to the Windows registry keys that control the Chrome Extension Install Allowlist. Unauthorized changes to these keys may indicate attempts to bypass Chrome extension restrictions or install unapproved extensions. This detection helps identify potential security policy violations or malicious activity targeting Chrome extension settings.
+data_source:
+- Sysmon EventID 13
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
+  where Registry.registry_path = "*\\Google\\Chrome\\ExtensionInstallAllowlist*"
+  by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path
+  Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name
+  Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_chrome_extension_allowed_registry_modification_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the registry value name, registry path, and registry value data from your
+  endpoints. If you are using Sysmon, you must have at least version 2.0 of the official
+  Sysmon TA. https://splunkbase.splunk.com/app/5709
+known_false_positives: Legitimate IT admin updates to Chrome extension allowlist via Group Policy or enterprise management tools. Filtering is needed.
+references:
+- https://www.gdatasoftware.com/blog/2025/11/38298-learning-about-browser-hijacking
+drilldown_searches:
+  - name: View the detection results for - "$dest$"
+    search: '%original_detection_search% | search  dest = "$dest$"'
+    earliest_offset: $info_min_time$
+    latest_offset: $info_max_time$
+  - name: View risk events for the last 7 days for - "$dest$"
+    search:
+      '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
+      starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime
+      values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
+      as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
+      as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
+      | `security_content_ctime(lastTime)`'
+    earliest_offset: $info_min_time$
+    latest_offset: $info_max_time$
+rba:
+  message: ExtensionInstallAllowlist Policy in $registry_path$ was modified on $dest$
+  risk_objects:
+  - field: dest
+    type: system
+    score: 30
+  threat_objects: []
+tags:
+  analytic_story:
+  - Browser Hijacking
+  asset_type: Endpoint
+  mitre_attack_id:
+  - T1185
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/chrome_allow_list/chrome_extension_allow_list.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog

detections/endpoint/windows_chrome_extension_load_via_command_line.yml

@@ -0,0 +1,71 @@
+name: Windows Chrome Extension Load via Command-Line
+id: 1b8a468a-52e3-4206-b14a-73165441684c
+version: 1
+date: '2025-12-17'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+description: The following analytic detects instances where Google Chrome is started with the --load-extension command-line flag, which allows loading unpacked or non-standard extensions. This behavior can indicate attempts to bypass enterprise extension policies, install malicious extensions, or load potentially harmful browser components. Monitoring such activity helps identify unauthorized extension usage, potential malware persistence mechanisms, or policy violations that could compromise browser security.
+data_source:
+- Sysmon EventID 1
+- Windows Event Log Security 4688
+- CrowdStrike ProcessRollup2
+search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where  Processes.process_name = "Chrome.exe" Processes.process= "*--load-extension*"
+  by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
+  Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
+  Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
+  Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
+  Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_chrome_extension_load_via_command_line_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Developers or IT admins loading unpacked extensions for testing or deployment purposes.
+references:
+- https://www.gdatasoftware.com/blog/2025/11/38298-learning-about-browser-hijacking
+drilldown_searches:
+- name: View the detection results for - "$user$" and "$dest$"
+  search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$user$" and "$dest$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
+    "$dest$") starthoursago=168  | stats count min(_time) as firstTime max(_time)
+    as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
+    Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
+    as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
+    by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: a chrome.exe process commandline $process$ that load browser extension on $dest$.
+  risk_objects:
+  - field: dest
+    type: system
+    score: 20
+  threat_objects:
+  - field: parent_process_name
+    type: parent_process_name
+tags:
+  analytic_story:
+  - Browser Hijacking
+  asset_type: Endpoint
+  mitre_attack_id:
+  - T1185
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/chrome_load_extensions/chrome_load_extension.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog

stories/browser_hijacking.yml

@@ -0,0 +1,20 @@
+name: Browser Hijacking
+id: 530d884d-c40f-4da2-bcd6-11d36b36f6ee
+version: 1
+date: '2025-12-18'
+author: Teoderick Contreras, Splunk
+status: production
+description: These behaviors associated with browser hijacking techniques where malware manipulates browser configurations, preferences, or registry settings to alter browsing behavior, disable updates, and install unauthorized extensions. Modern hijackers may directly modify Chrome preference files, use automation to inject unwanted content, or change policy settings (including allowlisting extensions) to persist and evade standard protections. These actions often result in unwanted redirects, malicious extension loading, or persistent policy tampering that can compromise user browsing integrity and system security. Detecting such modifications helps identify potential hijacker activity early and supports incident response efforts.
+narrative: Browser hijacking is a common tactic used by malicious actors to gain control over a user’s browsing experience, often without their knowledge. Attackers manipulate browser settings, install unauthorized extensions, or modify registry keys to redirect traffic, inject ads, or persistently override security policies. In Chrome, this can include altering the Extension Install Allowlist or preference files to load malicious or unwanted extensions automatically. Such modifications not only degrade user experience but can also introduce malware, credential theft, or data leakage. Detecting these registry and policy changes provides early warning of hijacker activity, enabling timely remediation before wider compromise occurs.
+references:
+- https://www.gdatasoftware.com/blog/2025/11/38298-learning-about-browser-hijacking
+tags:
+  category:
+  - Data Destruction
+  - Malware
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection