Skip to content

Commit cbd4a79

Browse files
nasbenchnasbench
committed
update metadata
1 parent 2a76c41 commit cbd4a79

6 files changed

+181
-143
lines changed

‎detections/endpoint/windows_chrome_auto_update_disabled_via_registry.yml‎

Lines changed: 51 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,54 @@
11
name: Windows Chrome Auto-Update Disabled via Registry
22
id: 619eac6c-0f03-4699-ae29-5f337877bcf9
33
version: 1
4-
date: '2025-12-17'
4+
date: '2026-01-12'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: Anomaly
8-
description: The following analytic detects modifications to Windows registry keys that disable Google Chrome auto-updates. Changes to keys such as DisableAutoUpdateChecksCheckboxValue = 1, Update{8A69D345-D564-463C-AFF1-A69D9E530F96} = 0, UpdateDefault = 0, and AutoUpdateCheckPeriodMinutes = 0 can prevent Chrome from receiving security updates. This behavior may indicate attempts to bypass update policies, maintain unauthorized extensions, or facilitate malware persistence. Monitoring these registry changes helps identify potential policy violations or malicious activity targeting browser security.
8+
description: |
9+
The following analytic detects modifications to Windows registry values that disable Google Chrome auto-updates.
10+
Changes to values such as DisableAutoUpdateChecksCheckboxValue = 1, Update{8A69D345-D564-463C-AFF1-A69D9E530F96} = 0, UpdateDefault = 0, and AutoUpdateCheckPeriodMinutes = 0 can prevent Chrome from receiving security updates.
11+
This behavior may indicate attempts to bypass update policies, maintain unauthorized extensions, or facilitate malware persistence.
12+
Monitoring these registry changes helps identify potential policy violations or malicious activity targeting browser security.
913
data_source:
10-
- Sysmon EventID 13
11-
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry
12-
13-
where Registry.registry_path = "*\\Google\\Update*" AND
14-
(Registry.registry_value_name = "DisableAutoUpdateChecksCheckboxValue" AND Registry.registry_value_data = 0x00000001) OR
15-
(Registry.registry_value_name = "Update{8A69D345-D564-463C-AFF1-A69D9E530F96}" AND Registry.registry_value_data = 0x00000000) OR
16-
(Registry.registry_value_name = "UpdateDefault" AND Registry.registry_value_data = 0x00000000) OR
17-
(Registry.registry_value_name = "AutoUpdateCheckPeriodMinutes" AND Registry.registry_value_data = 0x00000000)
18-
19-
by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path
20-
Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name
14+
- Sysmon EventID 13
15+
search: |
16+
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry
17+
18+
where Registry.registry_path = "*\\Google\\Update*"
19+
AND
20+
(
21+
Registry.registry_value_name = "DisableAutoUpdateChecksCheckboxValue"
22+
Registry.registry_value_data = 0x00000001
23+
)
24+
OR
25+
(
26+
Registry.registry_value_name IN (
27+
"AutoUpdateCheckPeriodMinutes",
28+
"Update{8A69D345-D564-463C-AFF1-A69D9E530F96}",
29+
"UpdateDefault"
30+
)
31+
Registry.registry_value_data = 0x00000000
32+
)
33+
34+
by Registry.action Registry.dest Registry.process_guid Registry.process_id
35+
Registry.registry_hive Registry.registry_path Registry.registry_key_name
36+
Registry.registry_value_data Registry.registry_value_name
2137
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
2238
23-
| `drop_dm_object_name(Registry)`
24-
| `security_content_ctime(firstTime)`
25-
| `security_content_ctime(lastTime)`
26-
| `windows_chrome_auto_update_disabled_via_registry_filter`'
27-
how_to_implement: To successfully implement this search, you need to be ingesting
39+
| `drop_dm_object_name(Registry)`
40+
| `security_content_ctime(firstTime)`
41+
| `security_content_ctime(lastTime)`
42+
| `windows_chrome_auto_update_disabled_via_registry_filter`
43+
how_to_implement: |
44+
To successfully implement this search, you need to be ingesting
2845
logs with the registry value name, registry path, and registry value data from your
2946
endpoints. If you are using Sysmon, you must have at least version 2.0 of the official
3047
Sysmon TA. https://splunkbase.splunk.com/app/5709
31-
known_false_positives: IT administrators intentionally disabling auto-updates in managed environments for testing, compatibility, or deployment purposes.
48+
known_false_positives: |
49+
IT administrators intentionally disabling auto-updates in managed environments for testing, compatibility, or deployment purposes.
3250
references:
33-
- https://www.gdatasoftware.com/blog/2025/11/38298-learning-about-browser-hijacking
51+
- https://www.gdatasoftware.com/blog/2025/11/38298-learning-about-browser-hijacking
3452
drilldown_searches:
3553
- name: View the detection results for - "$dest$"
3654
search: '%original_detection_search% | search dest = "$dest$"'
@@ -49,24 +67,24 @@ drilldown_searches:
4967
rba:
5068
message: Chrome Auto-update in $registry_path$ was disabled on $dest$
5169
risk_objects:
52-
- field: dest
53-
type: system
54-
score: 20
70+
- field: dest
71+
type: system
72+
score: 20
5573
threat_objects: []
5674
tags:
5775
analytic_story:
58-
- Browser Hijacking
76+
- Browser Hijacking
5977
asset_type: Endpoint
6078
mitre_attack_id:
61-
- T1185
79+
- T1185
6280
product:
63-
- Splunk Enterprise
64-
- Splunk Enterprise Security
65-
- Splunk Cloud
81+
- Splunk Enterprise
82+
- Splunk Enterprise Security
83+
- Splunk Cloud
6684
security_domain: endpoint
6785
tests:
68-
- name: True Positive Test
69-
attack_data:
70-
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/disable_chrome_update/disable_chrome_update.log
71-
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
72-
sourcetype: XmlWinEventLog
86+
- name: True Positive Test
87+
attack_data:
88+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/disable_chrome_update/disable_chrome_update.log
89+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
90+
sourcetype: XmlWinEventLog

‎detections/endpoint/windows_chrome_enable_extension_loading_via_command_line.yml‎

Lines changed: 34 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,33 @@
11
name: Windows Chrome Enable Extension Loading via Command-Line
22
id: da355155-1d23-48f9-bf95-e534ae273ab0
33
version: 1
4-
date: '2025-12-17'
4+
date: '2026-01-12'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: Anomaly
8-
description: The following analytic detects instances where Google Chrome is started with the --disable-features=DisableLoadExtensionCommandLineSwitch flag, effectively enabling the loading of extensions via the command line. This may indicate attempts to bypass enterprise extension policies, load unauthorized or malicious extensions, or manipulate browser behavior. Monitoring this activity helps identify potential security policy violations, malware persistence techniques, or other suspicious Chrome modifications.
8+
description: |
9+
The following analytic detects instances where Google Chrome is started with the --disable-features=DisableLoadExtensionCommandLineSwitch flag, effectively enabling the loading of extensions via the command line.
10+
This may indicate attempts to bypass enterprise extension policies, load unauthorized or malicious extensions, or manipulate browser behavior.
11+
Monitoring this activity helps identify potential security policy violations, malware persistence techniques, or other suspicious Chrome modifications.
912
data_source:
1013
- Sysmon EventID 1
1114
- Windows Event Log Security 4688
1215
- CrowdStrike ProcessRollup2
13-
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
14-
where Processes.process_name = "Chrome.exe" Processes.process= "*--disable-features=DisableLoadExtensionCommandLineSwitch*"
16+
search: |
17+
| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime
18+
from datamodel=Endpoint.Processes where
19+
Processes.process_name = "Chrome.exe"
20+
Processes.process= "*--disable-features*"
21+
Processes.process= "*DisableLoadExtensionCommandLineSwitch*"
1522
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
16-
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
17-
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
18-
Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
19-
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
20-
| `drop_dm_object_name(Processes)`
21-
| `security_content_ctime(firstTime)`
22-
| `security_content_ctime(lastTime)`
23-
| `windows_chrome_enable_extension_loading_via_command_line_filter`'
23+
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
24+
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
25+
Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
26+
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
27+
| `drop_dm_object_name(Processes)`
28+
| `security_content_ctime(firstTime)`
29+
| `security_content_ctime(lastTime)`
30+
| `windows_chrome_enable_extension_loading_via_command_line_filter`
2431
how_to_implement: To successfully implement this search you need to be ingesting information
2532
on process that include the name of the process responsible for the changes from
2633
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -44,28 +51,32 @@ drilldown_searches:
4451
earliest_offset: $info_min_time$
4552
latest_offset: $info_max_time$
4653
rba:
47-
message: a chrome.exe process commandline $process$ that enable browser extension loading in commandline on $dest$.
54+
message: A $process_name$ process attempted to enable browser extension loading via command line $process$ on $dest$.
4855
risk_objects:
4956
- field: dest
5057
type: system
5158
score: 30
5259
threat_objects:
5360
- field: parent_process_name
5461
type: parent_process_name
62+
- field: process_name
63+
type: process_name
64+
- field: process
65+
type: process
5566
tags:
5667
analytic_story:
57-
- Browser Hijacking
68+
- Browser Hijacking
5869
asset_type: Endpoint
5970
mitre_attack_id:
60-
- T1185
71+
- T1185
6172
product:
62-
- Splunk Enterprise
63-
- Splunk Enterprise Security
64-
- Splunk Cloud
73+
- Splunk Enterprise
74+
- Splunk Enterprise Security
75+
- Splunk Cloud
6576
security_domain: endpoint
6677
tests:
67-
- name: True Positive Test
68-
attack_data:
69-
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/chrome_load_extensions/chrome_load_extension.log
70-
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
71-
sourcetype: XmlWinEventLog
78+
- name: True Positive Test
79+
attack_data:
80+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/chrome_load_extensions/chrome_load_extension.log
81+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
82+
sourcetype: XmlWinEventLog

‎detections/endpoint/windows_chrome_extension_allowed_registry_modification.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,21 @@
11
name: Windows Chrome Extension Allowed Registry Modification
22
id: 2846089a-ffe9-4881-a2a2-43f3be2b8cc7
33
version: 1
4-
date: '2025-12-17'
4+
date: '2026-01-12'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: Anomaly
88
description: The following analytic detects modifications to the Windows registry keys that control the Chrome Extension Install Allowlist. Unauthorized changes to these keys may indicate attempts to bypass Chrome extension restrictions or install unapproved extensions. This detection helps identify potential security policy violations or malicious activity targeting Chrome extension settings.
99
data_source:
10-
- Sysmon EventID 13
11-
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry
10+
- Sysmon EventID 13
11+
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry
1212
where Registry.registry_path = "*\\Google\\Chrome\\ExtensionInstallAllowlist*"
1313
by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path
1414
Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name
1515
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
16-
| `drop_dm_object_name(Registry)`
17-
| `security_content_ctime(firstTime)`
18-
| `security_content_ctime(lastTime)`
16+
| `drop_dm_object_name(Registry)`
17+
| `security_content_ctime(firstTime)`
18+
| `security_content_ctime(lastTime)`
1919
| `windows_chrome_extension_allowed_registry_modification_filter`'
2020
how_to_implement: To successfully implement this search, you need to be ingesting
2121
logs with the registry value name, registry path, and registry value data from your
@@ -40,7 +40,7 @@ drilldown_searches:
4040
earliest_offset: $info_min_time$
4141
latest_offset: $info_max_time$
4242
rba:
43-
message: ExtensionInstallAllowlist Policy in $registry_path$ was modified on $dest$
43+
message: Chrome ExtensionInstallAllowlist Policy in $registry_path$ was modified on $dest$
4444
risk_objects:
4545
- field: dest
4646
type: system

‎detections/endpoint/windows_chrome_extension_load_via_command_line.yml‎

Lines changed: 0 additions & 71 deletions
This file was deleted.

0 commit comments

Comments
 (0)