Windows: Chromium-Based Browser Launched With --load-extension Custom Flag

title: "Windows: Chromium-Based Browser Launched With --load-extension Custom Flag"
id: 2c483492-ca0c-48f7-9375-414b189d35cd
related:
  - id: 27ba3207-dd30-4812-abbf-5d20c57d474e
    type: similar
  - id: 88d6e60c-759d-4ac1-a447-c0f1466c2d21
    type: derived
status: test
description: This rule flags execution of common Chromium-based browsers (Chrome, Edge, Brave, Opera, Vivaldi) where the command line includes a --load-extension= argument. Attackers can abuse this behavior to load custom extensions at browser startup, enabling persistence or malicious functionality. The detection relies on Windows process creation telemetry, matching the executable image name and the presence of the extension-loading flag in the command line.
references:
  - https://redcanary.com/blog/chromeloader/
  - https://emkc.org/s/RJjuLa
  - https://www.mandiant.com/resources/blog/lnk-between-browsers
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_browsers_chromium_load_extension.yml
author: Aedan Russell, frack113, X__Junior (Nextron Systems), Huntrule Team
date: 2022-06-19
modified: 2023-11-28
tags:
  - attack.persistence
  - attack.t1176.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - \brave.exe
      - \chrome.exe
      - \msedge.exe
      - \opera.exe
      - \vivaldi.exe
    CommandLine|contains: --load-extension=
  condition: selection
falsepositives:
  - Usage of Chrome Extensions in testing tools such as BurpSuite will trigger this alert
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_load_extension/info.yml
license: DRL-1.1