082. Huniting for Malicious Browser Extensions

Hello everyone! Malicious browser extensions are stopping to be an exotic threat. For example, Rilide. It was first reported in April 2023, but became a common threat, and this report is another proof of it.

Can we hunt for such extensions? Of course, yes! For example, usually threats like Rilide modify browser-reated LNK files to run it with "--load-extension" argument, like this:

chrome.exe --load-extension="C:\Users\user\AppData\Local\Temp\MalExt"

It means we can hunt for execution of common Chromium-based browsers with this argument:

event_type: "processcreatewin"

AND

proc_file_name: ("chrome.exe" OR "brave.exe" OR "opera.exe" OR "msedge.exe") 

AND

cmdline: "load-extension"

I'm sure you'll get false positives, but this is what we expect from threat hunting, right? Proper filtering will help you, I'm sure!

See you tomorrow!