Windows ChromeLoader execution via scheduled task and Chrome extension loading

title: Windows ChromeLoader execution via scheduled task and Chrome extension loading
id: e1797b36-ca61-4d21-80e4-5b49c999f7af
status: test
description: This rule identifies execution of a Chrome-based payload where chrome.exe is launched by PowerShell using an execution-policy bypass and hidden window parameters. It also matches command lines that include a flag for loading a Chrome extension from an AppData local Chrome path. This pattern matters because attackers can use PowerShell to evade user visibility and then execute malicious logic through Chrome’s extension loading mechanism, often as a persistence or execution workflow. Telemetry required is Windows process creation including the parent image, parent command line, and the spawned process command line.
references:
  - https://github.com/xephora/Threat-Remediation-Scripts/tree/main/Threat-Track/CS_INSTALLER
  - https://twitter.com/th3_protoCOL/status/1480621526764322817
  - https://twitter.com/Kostastsale/status/1480716528421011458
  - https://www.virustotal.com/gui/file/ded20df574b843aaa3c8e977c2040e1498ae17c12924a19868df5b12dee6dfdd
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Malware/ChromeLoader/proc_creation_win_malware_chrome_loader_execution.yml
author: "@kostastsale, Huntrule Team"
date: 2022-01-10
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053.005
  - attack.t1059.001
  - attack.t1176
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \powershell.exe
    ParentCommandLine|contains: -ExecutionPolicy Bypass -WindowStyle Hidden -E JAB
    CommandLine|contains: --load-extension="*\Appdata\local\chrome"
    Image|endswith: \chrome.exe
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 0a74c5a9-1b71-4475-9af2-7829d320d5c2
    type: derived