Windows ChromeLoader Execution via Scheduled Task and Hidden PowerShell Launch
Flags PowerShell-launched chrome.exe that uses --load-extension from local AppData Chrome paths for ChromeLoader-style execution.
- Product
- windows
- Category
- process_creation
- Author
- @kostastsale (SigmaHQ), DRL 1.1
- Published
- 2022-01-10
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches process creation where a chrome.exe child process is launched and the parent process is powershell.exe executing with an execution policy bypass and hidden window parameters. It also requires the PowerShell command line to include a specific Chrome extension loading argument pointing to the AppData local chrome directory. This behavior is relevant because attackers can use scheduled-task-driven PowerShell to run a staged loader that triggers Chrome to execute malicious extensions; the rule relies on Windows process creation telemetry including Image, ParentImage, ParentCommandLine, and CommandLine.
Reporting behind it
- github.comhttps://github.com/xephora/Threat-Remediation-Scripts/tree/main/Threat-Track/CS_INSTALLER
- twitter.comhttps://twitter.com/th3_protoCOL/status/1480621526764322817
- twitter.comhttps://twitter.com/Kostastsale/status/1480716528421011458
- virustotal.comhttps://www.virustotal.com/gui/file/ded20df574b843aaa3c8e977c2040e1498ae17c12924a19868df5b12dee6dfdd
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Malware/ChromeLoader/proc_creation_win_malware_chrome_loader_execution.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows ChromeLoader Execution via Scheduled Task and Hidden PowerShell Launch
id: e1797b36-ca61-4d21-80e4-5b49c999f7af
status: test
description: This rule matches process creation where a chrome.exe child process is launched and the parent process is powershell.exe executing with an execution policy bypass and hidden window parameters. It also requires the PowerShell command line to include a specific Chrome extension loading argument pointing to the AppData local chrome directory. This behavior is relevant because attackers can use scheduled-task-driven PowerShell to run a staged loader that triggers Chrome to execute malicious extensions; the rule relies on Windows process creation telemetry including Image, ParentImage, ParentCommandLine, and CommandLine.
references:
- https://github.com/xephora/Threat-Remediation-Scripts/tree/main/Threat-Track/CS_INSTALLER
- https://twitter.com/th3_protoCOL/status/1480621526764322817
- https://twitter.com/Kostastsale/status/1480716528421011458
- https://www.virustotal.com/gui/file/ded20df574b843aaa3c8e977c2040e1498ae17c12924a19868df5b12dee6dfdd
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Malware/ChromeLoader/proc_creation_win_malware_chrome_loader_execution.yml
author: "@kostastsale, Huntrule Team"
date: 2022-01-10
tags:
- attack.privilege-escalation
- attack.execution
- attack.persistence
- attack.t1053.005
- attack.t1059.001
- attack.t1176
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \powershell.exe
ParentCommandLine|contains: -ExecutionPolicy Bypass -WindowStyle Hidden -E JAB
CommandLine|contains: --load-extension="*\Appdata\local\chrome"
Image|endswith: \chrome.exe
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 0a74c5a9-1b71-4475-9af2-7829d320d5c2
type: derived