Skip to content

Commit 890de16

Browse files
t-contrerast-contreras
committed
innoloader
1 parent e07722a commit 890de16

5 files changed

+233
-10
lines changed

‎detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Non Chrome Process Accessing Chrome Default Dir
22
id: 81263de4-160a-11ec-944f-acde48001122
3-
version: 10
4-
date: '2025-05-02'
3+
version: 11
4+
date: '2025-05-25'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: Anomaly
@@ -15,10 +15,11 @@ description: The following analytic detects a non-Chrome process accessing files
1515
and further compromise of the affected system.
1616
data_source:
1717
- Windows Event Log Security 4663
18-
search: '`wineventlog_security` EventCode=4663 NOT (ProcessName IN ("*\\chrome.exe",
19-
"*\\explorer.exe", "*sql*")) ObjectName="*\\Google\\Chrome\\User Data\\Default*"
20-
| stats count min(_time) as firstTime max(_time) as lastTime by ObjectName ObjectType
21-
ProcessName AccessMask EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
18+
search: '`wineventlog_security` EventCode=4663
19+
NOT (ProcessName IN ("*\\chrome.exe", "*\\explorer.exe", "*sql*", "*\\dllhost.exe")) ObjectName="*\\Google\\Chrome\\User Data\\Default*"
20+
| stats count min(_time) as firstTime max(_time) as lastTime by ObjectName ObjectType ProcessName AccessMask EventCode dest
21+
| `security_content_ctime(firstTime)`
22+
| `security_content_ctime(lastTime)`
2223
| `non_chrome_process_accessing_chrome_default_dir_filter`'
2324
how_to_implement: To successfully implement this search, you must ingest Windows Security
2425
Event logs and track event code 4663. For 4663, enable "Audit Object Access" in
@@ -63,6 +64,7 @@ tags:
6364
- 3CX Supply Chain Attack
6465
- DarkGate Malware
6566
- NjRAT
67+
- Malicious Inno Setup Loader
6668
asset_type: Endpoint
6769
mitre_attack_id:
6870
- T1555.003

‎detections/endpoint/windows_chromium_browser_no_security_sandbox_process.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: Windows Chromium Browser No Security Sandbox Process
2+
id: 314cb263-7eeb-4d45-b693-bb21699c73d2
3+
version: 1
4+
date: '2025-05-26'
5+
author: Teoderick Contreras, Splunk
6+
status: production
7+
type: TTP
8+
description: The following analytic detects instances where a Chrome or Chromium-based browser is launched with the --no-sandbox flag, a known indicator of potentially malicious or suspicious behavior. While this flag is occasionally used during software development or testing, it is rarely seen in normal user activity. Threat actors often abuse this setting to disable Chrome’s built-in security sandbox, making it easier to execute malicious code or escape browser isolation. This behavior is commonly observed in malware droppers or loaders that embed Chromium components for command and control, credential theft, or UI spoofing. Analysts should investigate such events, especially if they originate from unusual parent processes (e.g., powershell.exe, cmd.exe, or unknown binaries), or if accompanied by other indicators such as file drops, process injection, or outbound network activity. Filtering by command-line arguments and process ancestry can help reduce false positives and surface high-fidelity detections.
9+
data_source:
10+
- Sysmon EventID 1
11+
- Windows Event Log Security 4688
12+
- CrowdStrike ProcessRollup2
13+
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
14+
as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("chrome.exe","Brave.exe", "Opera.exe", "Vivaldi.exe")
15+
Processes.process = "*--no-sandbox*"
16+
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
17+
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
18+
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
19+
Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
20+
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
21+
| `drop_dm_object_name(Processes)`
22+
| `security_content_ctime(firstTime)`
23+
| `security_content_ctime(lastTime)`
24+
| `windows_chromium_browser_no_security_sandbox_process_filter`'
25+
how_to_implement: To successfully implement this search you need to be ingesting information
26+
on process that include the name of the process responsible for the changes from
27+
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
28+
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
29+
endpoint product.
30+
known_false_positives: Administrators may enable or disable this feature that may
31+
cause some false positive.
32+
references:
33+
- https://unix.stackexchange.com/questions/68832/what-does-the-chromium-option-no-sandbox-mean
34+
drilldown_searches:
35+
- name: View the detection results for - "$user$" and "$dest$"
36+
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
37+
earliest_offset: $info_min_time$
38+
latest_offset: $info_max_time$
39+
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
40+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
41+
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
42+
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
43+
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
44+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
45+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
46+
earliest_offset: $info_min_time$
47+
latest_offset: $info_max_time$
48+
rba:
49+
message: A chrome process with the --no-sandbox flag was launched on $dest$ by user $user$.
50+
risk_objects:
51+
- field: dest
52+
type: system
53+
score: 60
54+
threat_objects:
55+
- field: parent_process_name
56+
type: parent_process_name
57+
tags:
58+
analytic_story:
59+
- Malicious Inno Setup Loader
60+
asset_type: Endpoint
61+
mitre_attack_id:
62+
- T1497
63+
product:
64+
- Splunk Enterprise
65+
- Splunk Enterprise Security
66+
- Splunk Cloud
67+
security_domain: endpoint
68+
tests:
69+
- name: True Positive Test
70+
attack_data:
71+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1497/chrom_no_sandbox/chrome-no_sandbox.log
72+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
73+
sourcetype: XmlWinEventLog

‎detections/endpoint/windows_chromium_browser_with_custom_user_data_directory.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: Windows Chromium Browser with Custom User Data Directory
2+
id: 4f546cf4-15aa-4368-80f7-940e92bc551e
3+
version: 1
4+
date: '2025-05-26'
5+
author: Teoderick Contreras, Splunk
6+
status: production
7+
type: Anomaly
8+
description: The following analytic detects instances where the Chromium-based browser (e.g., Google Chrome, Microsoft Edge) is launched with the --user-data-dir command-line argument. While this flag is legitimate and used for multi-profile support or automation, it is frequently leveraged by malware and adversaries to run Chrome in an isolated environment for stealth operations, credential harvesting, phishing delivery, or evasion of user session artifacts.
9+
data_source:
10+
- Sysmon EventID 1
11+
- Windows Event Log Security 4688
12+
- CrowdStrike ProcessRollup2
13+
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
14+
as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("chrome.exe", "msedge.exe", "brave.exe")
15+
Processes.process = "*--user-data-dir*" Processes.process IN ("*--disable-gpu*", "*--disable-3d-apis*")
16+
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
17+
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
18+
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
19+
Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
20+
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
21+
| `drop_dm_object_name(Processes)`
22+
| `security_content_ctime(firstTime)`
23+
| `security_content_ctime(lastTime)`
24+
| `windows_chromium_browser_with_custom_user_data_directory_filter`'
25+
how_to_implement: To successfully implement this search you need to be ingesting information
26+
on process that include the name of the process responsible for the changes from
27+
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
28+
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
29+
endpoint product.
30+
known_false_positives: Administrators may enable or disable this feature that may
31+
cause some false positive.
32+
references:
33+
- https://chromium.googlesource.com/chromium/src/+/main/docs/user_data_dir.md
34+
drilldown_searches:
35+
- name: View the detection results for - "$user$" and "$dest$"
36+
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
37+
earliest_offset: $info_min_time$
38+
latest_offset: $info_max_time$
39+
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
40+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
41+
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
42+
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
43+
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
44+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
45+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
46+
earliest_offset: $info_min_time$
47+
latest_offset: $info_max_time$
48+
rba:
49+
message: A chrome process with the --user-data-dir flag was launched on $dest$ by user $user$.
50+
risk_objects:
51+
- field: dest
52+
type: system
53+
score: 40
54+
threat_objects:
55+
- field: parent_process_name
56+
type: parent_process_name
57+
tags:
58+
analytic_story:
59+
- Malicious Inno Setup Loader
60+
asset_type: Endpoint
61+
mitre_attack_id:
62+
- T1497
63+
product:
64+
- Splunk Enterprise
65+
- Splunk Enterprise Security
66+
- Splunk Cloud
67+
security_domain: endpoint
68+
tests:
69+
- name: True Positive Test
70+
attack_data:
71+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1497/chrom_no_sandbox/chrome-no_sandbox.log
72+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
73+
sourcetype: XmlWinEventLog

‎detections/endpoint/windows_disable_browser_extensions.yml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
name: Windows Disable Browser Extensions
2+
id: 65224d8b-b95d-44ec-bb44-408d830c1258
3+
version: 1
4+
date: '2025-05-26'
5+
author: Teoderick Contreras, Splunk
6+
status: production
7+
type: TTP
8+
description: The following analytic detects the execution of iexplore.exe (Internet Explorer) with the -extoff command-line flag, which disables all browser extensions. This flag is commonly abused by adversaries to launch a clean browser session that bypasses security controls such as antivirus browser extensions, toolbars, or group policy-enforced add-ons.
9+
Malicious documents or scripts may leverage iexplore.exe -extoff to open phishing pages, command-and-control interfaces, or download additional payloads in an environment free from security monitoring plugins. While this flag may be used legitimately by IT administrators for troubleshooting purposes, its use in modern enterprise environments is rare and should be considered suspicious—particularly when launched by Office applications, scripting engines (e.g., PowerShell, WScript), or scheduled tasks.
10+
data_source:
11+
- Sysmon EventID 1
12+
- Windows Event Log Security 4688
13+
- CrowdStrike ProcessRollup2
14+
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
15+
as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "iexplore.exe"
16+
Processes.process = "*-extoff*"
17+
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
18+
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
19+
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
20+
Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
21+
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
22+
| `drop_dm_object_name(Processes)`
23+
| `security_content_ctime(firstTime)`
24+
| `security_content_ctime(lastTime)`
25+
| `windows_disable_browser_extensions_filter`'
26+
how_to_implement: To successfully implement this search you need to be ingesting information
27+
on process that include the name of the process responsible for the changes from
28+
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
29+
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
30+
endpoint product.
31+
known_false_positives: Administrators may enable or disable this feature that may
32+
cause some false positive.
33+
references:
34+
- https://www.hybrid-analysis.com/sample/e285feeca968b3ca22017a64363eea5e69ccd519696671df523291b089597875/588175f1aac2edf92bbed32f
35+
drilldown_searches:
36+
- name: View the detection results for - "$user$" and "$dest$"
37+
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
38+
earliest_offset: $info_min_time$
39+
latest_offset: $info_max_time$
40+
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
41+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
42+
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
43+
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
44+
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
45+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
46+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
47+
earliest_offset: $info_min_time$
48+
latest_offset: $info_max_time$
49+
rba:
50+
message: A iexplore.exe process with the -extoff flag was launched on $dest$ by user $user$.
51+
risk_objects:
52+
- field: dest
53+
type: system
54+
score: 40
55+
threat_objects:
56+
- field: parent_process_name
57+
type: parent_process_name
58+
tags:
59+
analytic_story:
60+
- Malicious Inno Setup Loader
61+
asset_type: Endpoint
62+
mitre_attack_id:
63+
- T1176.001
64+
product:
65+
- Splunk Enterprise
66+
- Splunk Enterprise Security
67+
- Splunk Cloud
68+
security_domain: endpoint
69+
tests:
70+
- name: True Positive Test
71+
attack_data:
72+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1176.001/disable_extension/iexplore-extoff.log
73+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
74+
sourcetype: XmlWinEventLog

‎detections/endpoint/windows_hidden_schedule_task_settings.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,10 @@ description: The following analytic detects the creation of hidden scheduled tas
1515
malicious payloads.
1616
data_source:
1717
- Windows Event Log Security 4698
18-
search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Hidden = true
19-
| stats count min(_time) as firstTime max(_time) as lastTime by Task_Name, Command,
20-
Author, Hidden, dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
18+
search: '`wineventlog_security` EventCode=4698 TaskContent = "*<Hidden>true</Hidden>*"
19+
| stats count min(_time) as firstTime max(_time) as lastTime by TaskName TaskContent action signature status dest
20+
| `security_content_ctime(firstTime)`
21+
| `security_content_ctime(lastTime)`
2122
| `windows_hidden_schedule_task_settings_filter`'
2223
how_to_implement: To successfully implement this search, you need to be ingesting
2324
logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and
@@ -68,6 +69,6 @@ tags:
6869
tests:
6970
- name: True Positive Test
7071
attack_data:
71-
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053/hidden_schedule_task/security.log
72+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053/hidden_schedule_task/inno_schtask.log
7273
source: WinEventLog:Security
7374
sourcetype: WinEventLog

0 commit comments

Comments
 (0)