Windows Registry Startup: Chrome VPN Extensions Installed via Extension Registry Keys

title: "Windows Registry Startup: Chrome VPN Extensions Installed via Extension Registry Keys"
id: 11e7de86-0649-41e6-85d3-0e576f71ac27
status: test
description: This rule identifies when Google Chrome extensions that provide VPN/proxy functionality are registered through Windows Registry entries under the Chrome Extensions update_url path. Attackers may use Chrome extensions to establish persistent network routing and conceal traffic by automating extension installation or configuration. The rule relies on Windows Registry set telemetry by matching specific Chrome extension TargetObject identifiers and confirming the Registry location ends with update_url under the Chrome 32-bit extension path.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1133/T1133.md#atomic-test-1---running-chrome-vpn-extensions-via-the-registry-2-vpn-extension
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_chrome_extension.yml
author: frack113, Huntrule Team
date: 2021-12-28
modified: 2023-08-17
tags:
  - attack.initial-access
  - attack.persistence
  - attack.t1133
logsource:
  category: registry_set
  product: windows
detection:
  chrome_ext:
    TargetObject|contains: Software\Wow6432Node\Google\Chrome\Extensions
    TargetObject|endswith: update_url
  chrome_vpn:
    TargetObject|contains:
      - fdcgdnkidjaadafnichfpabhfomcebme
      - fcfhplploccackoneaefokcmbjfbkenj
      - bihmplhobchoageeokmgbdihknkjbknd
      - gkojfkhlekighikafcpjkiklfbnlmeio
      - jajilbjjinjmgcibalaakngmkilboobh
      - gjknjjomckknofjidppipffbpoekiipm
      - nabbmpekekjknlbkgpodfndbodhijjem
      - kpiecbcckbofpmkkkdibbllpinceiihk
      - nlbejmccbhkncgokjcmghpfloaajcffj
      - omghfjlpggmjjaagoclmmobgdodcjboh
      - bibjcjfmgapbfoljiojpipaooddpkpai
      - mpcaainmfjjigeicjnlkdfajbioopjko
      - jljopmgdobloagejpohpldgkiellmfnc
      - lochiccbgeohimldjooaakjllnafhaid
      - nhnfcgpcbfclhfafjlooihdfghaeinfc
      - ookhnhpkphagefgdiemllfajmkdkcaim
      - namfblliamklmeodpcelkokjbffgmeoo
      - nbcojefnccbanplpoffopkoepjmhgdgh
      - majdfhpaihoncoakbjgbdhglocklcgno
      - lnfdmdhmfbimhhpaeocncdlhiodoblbd
      - eppiocemhmnlbhjplcgkofciiegomcon
      - cocfojppfigjeefejbpfmedgjbpchcng
      - foiopecknacmiihiocgdjgbjokkpkohc
      - hhdobjgopfphlmjbmnpglhfcgppchgje
      - jgbaghohigdbgbolncodkdlpenhcmcge
      - inligpkjkhbpifecbdjhmdpcfhnlelja
      - higioemojdadgdbhbbbkfbebbdlfjbip
      - hipncndjamdcmphkgngojegjblibadbe
      - iolonopooapdagdemdoaihahlfkncfgg
      - nhfjkakglbnnpkpldhjmpmmfefifedcj
      - jpgljfpmoofbmlieejglhonfofmahini
      - fgddmllnllkalaagkghckoinaemmogpe
      - ejkaocphofnobjdedneohbbiilggdlbi
      - keodbianoliadkoelloecbhllnpiocoi
      - hoapmlpnmpaehilehggglehfdlnoegck
      - poeojclicodamonabcabmapamjkkmnnk
      - dfkdflfgjdajbhocmfjolpjbebdkcjog
      - kcdahmgmaagjhocpipbodaokikjkampi
      - klnkiajpmpkkkgpgbogmcgfjhdoljacg
      - lneaocagcijjdpkcabeanfpdbmapcjjg
      - pgfpignfckbloagkfnamnolkeaecfgfh
      - jplnlifepflhkbkgonidnobkakhmpnmh
      - jliodmnojccaloajphkingdnpljdhdok
      - hnmpcagpplmpfojmgmnngilcnanddlhb
      - ffbkglfijbcbgblgflchnbphjdllaogb
      - kcndmbbelllkmioekdagahekgimemejo
      - jdgilggpfmjpbodmhndmhojklgfdlhob
      - bihhflimonbpcfagfadcnbbdngpopnjb
      - ppajinakbfocjfnijggfndbdmjggcmde
      - oofgbpoabipfcfjapgnbbjjaenockbdp
      - bhnhkdgoefpmekcgnccpnhjfdgicfebm
      - knmmpciebaoojcpjjoeonlcjacjopcpf
      - dhadilbmmjiooceioladdphemaliiobo
      - jedieiamjmoflcknjdjhpieklepfglin
      - mhngpdlhojliikfknhfaglpnddniijfh
      - omdakjcmkglenbhjadbccaookpfjihpa
      - npgimkapccfidfkfoklhpkgmhgfejhbj
      - akeehkgglkmpapdnanoochpfmeghfdln
      - gbmdmipapolaohpinhblmcnpmmlgfgje
      - aigmfoeogfnljhnofglledbhhfegannp
      - cgojmfochfikphincbhokimmmjenhhgk
      - ficajfeojakddincjafebjmfiefcmanc
      - ifnaibldjfdmaipaddffmgcmekjhiloa
      - jbnmpdkcfkochpanomnkhnafobppmccn
      - apcfdffemoinopelidncddjbhkiblecc
      - mjolnodfokkkaichkcjipfgblbfgojpa
      - oifjbnnafapeiknapihcmpeodaeblbkn
      - plpmggfglncceinmilojdkiijhmajkjh
      - mjnbclmflcpookeapghfhapeffmpodij
      - bblcccknbdbplgmdjnnikffefhdlobhp
      - aojlhgbkmkahabcmcpifbolnoichfeep
      - lcmammnjlbmlbcaniggmlejfjpjagiia
      - knajdeaocbpmfghhmijicidfcmdgbdpm
      - bdlcnpceagnkjnjlbbbcepohejbheilk
      - edknjdjielmpdlnllkdmaghlbpnmjmgb
      - eidnihaadmmancegllknfbliaijfmkgo
      - ckiahbcmlmkpfiijecbpflfahoimklke
      - macdlemfnignjhclfcfichcdhiomgjjb
      - chioafkonnhbpajpengbalkececleldf
      - amnoibeflfphhplmckdbiajkjaoomgnj
      - llbhddikeonkpbhpncnhialfbpnilcnc
      - pcienlhnoficegnepejpfiklggkioccm
      - iocnglnmfkgfedpcemdflhkchokkfeii
      - igahhbkcppaollcjeaaoapkijbnphfhb
      - njpmifchgidinihmijhcfpbdmglecdlb
      - ggackgngljinccllcmbgnpgpllcjepgc
      - kchocjcihdgkoplngjemhpplmmloanja
      - bnijmipndnicefcdbhgcjoognndbgkep
      - lklekjodgannjcccdlbicoamibgbdnmi
      - dbdbnchagbkhknegmhgikkleoogjcfge
      - egblhcjfjmbjajhjhpmnlekffgaemgfh
      - ehbhfpfdkmhcpaehaooegfdflljcnfec
      - bkkgdjpomdnfemhhkalfkogckjdkcjkg
      - almalgbpmcfpdaopimbdchdliminoign
      - akkbkhnikoeojlhiiomohpdnkhbkhieh
      - gbfgfbopcfokdpkdigfmoeaajfmpkbnh
      - bniikohfmajhdcffljgfeiklcbgffppl
      - lejgfmmlngaigdmmikblappdafcmkndb
      - ffhhkmlgedgcliajaedapkdfigdobcif
      - gcknhkkoolaabfmlnjonogaaifnjlfnp
      - pooljnboifbodgifngpppfklhifechoe
      - fjoaledfpmneenckfbpdfhkmimnjocfa
      - aakchaleigkohafkfjfjbblobjifikek
      - dpplabbmogkhghncfbfdeeokoefdjegm
      - padekgcemlokbadohgkifijomclgjgif
      - bfidboloedlamgdmenmlbipfnccokknp
  condition: all of chrome_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: b64a026b-8deb-4c1d-92fd-98893209dff1
    type: derived