Suspicious Chromium-Based Browser Launched with Custom Extension via --load-extension (Windows)

title: Suspicious Chromium-Based Browser Launched with Custom Extension via --load-extension (Windows)
id: f0f3f9ac-3623-4908-8e6d-65304b6645fc
related:
  - id: 88d6e60c-759d-4ac1-a447-c0f1466c2d21
    type: similar
  - id: 27ba3207-dd30-4812-abbf-5d20c57d474e
    type: derived
status: test
description: This rule identifies a process where a Chromium-based browser (Chrome, Edge, Brave, Opera, or Vivaldi) is started with the --load-extension= command-line argument. It focuses on execution where the browser process is launched by script or LOLBins-style parents such as cmd.exe, PowerShell, wscript/cscript, mshta, regsvr32, or rundll32, which can indicate abuse to load attacker-controlled extensions. Telemetry relies on Windows process creation events including parent and child process image names and the child process command line.
references:
  - https://redcanary.com/blog/chromeloader/
  - https://emkc.org/s/RJjuLa
  - https://www.mandiant.com/resources/blog/lnk-between-browsers
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_browsers_chromium_susp_load_extension.yml
author: Aedan Russell, frack113, X__Junior (Nextron Systems), Huntrule Team
date: 2022-06-19
modified: 2023-11-28
tags:
  - attack.persistence
  - attack.t1176.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - \cmd.exe
      - \cscript.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \wscript.exe
    Image|endswith:
      - \brave.exe
      - \chrome.exe
      - \msedge.exe
      - \opera.exe
      - \vivaldi.exe
    CommandLine|contains: --load-extension=
  condition: selection
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_susp_load_extension/info.yml
license: DRL-1.1