Elastic Defend high stable eql

Browser Debugging from Unusual Parent

Identifies the execution of a Chromium-based browser with the debugging process argument, which may indicate an attempt to steal authentication cookies. An adversary may steal web application or service session cookies and use them to access web applications or Internet services as an authenticated user without credentials.

View Source

Detection Logic

process where event.type == "start" and
   process.name : ("chrome.exe", "msedge.exe") and not user.id : "S-1-5-18" and
   process.code_signature.trusted == true and
   process.parent.executable != null and
   process.args : ("--remote-debugging-port=*",
                   "--remote-debugging-targets=*",
                   "--remote-debugging-pipe=*") and
   process.args : "--user-data-dir=*" and not process.args:"--remote-debugging-port=0" and
   not (process.parent.name == "chrome.exe" and process.parent.args == "--remote-debugging-host=127.0.0.1") and
   not process.parent.executable : ("?:\\Program Files\\Microsoft VS Code\\Code.exe",
                                    "?:\\Program Files (x86)\\PRTG Network Monitor\\Sensor System\\reporter.exe",
                                    "?:\\Program Files\\nodejs\\node.exe",
                                    "?:\\Windows\\System32\\inetsrv\\w3wp.exe",
                                    "?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
                                    "?:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
                                    "?:\\Program Files (x86)\\Brackets\\Brackets.exe",
                                    "?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                                    "?:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe",
                                    "?:\\Program Files\\OutSystems\\Development Environment*\\Service Studio\\ServiceStudio.exe",
                                    "?:\\Program Files (x86)\\CyberArk\\PSM\\Components\\chromedriver.exe",
                                    "?:\\Program Files\\Microsoft Visual Studio\\*\\node.exe",
                                    "?:\\Program Files (x86)\\Microsoft Visual Studio\\*\\node.exe",
                                    "?:\\Program Files (x86)\\Price Pro\\PricePro.exe",
                                    "?:\\Users\\*\\Versioning_SPCRepository\\SPCProcessor\\SPCEngine\\app.exe",
                                    "E:\\PRTG\\Sensor System\\reporter.exe" ,
                                    "E:\\eclipse\\chromedriver.exe",
                                    "c:\\ibi\\AppStudio82\\bin\\chromedriver.exe",
                                    "C:\\Windows\\chromedriver.exe",
                                    "?:\\Program Files\\Google\\Chrome Dev\\Application\\chrome.exe",
                                    "?:\\ibi\\AppStudio90\\bin\\chromedriver.exe",
                                    "?:\\Users\\*\\AppData\\Roaming\\nvm\\v*\\node.exe",
                                    "?:\\*\\bin\\cache\\dart-sdk\\bin\\dart.exe",
                                    "C:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe",
                                    "C:\\Program Files\\Python3??\\python.exe") and
   not (process.parent.executable : "?:\\Windows\\explorer.exe" and process.command_line : "*VisualStudio*") and
   not (process.parent.name : "chromedriver.exe" and process.parent.command_line : "*chromedriver.exe --port=*") and
   not (process.parent.executable : "?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe" and
        process.parent.command_line : "*--ms-enable-electron-run-as-node*") and
   not (process.parent.name : "node.exe" and process.parent.args : "--code-coverage") and
   not process.args :
             ("--user-data-dir=?:\\Users\\*\\AppData\\Local\\JetBrains\\WebStorm*\\chrome-user-data-*",
              "--user-data-dir=?:\\Users\\*\\AppData\\Local\\Temp\\1\\flutter_tools.*\\flutter_tools_chrome_device.*") and
   not process.parent.args : "?:\\Program Files\\nodejs\\node.exe" and
   not (process.parent.code_signature.subject_name == "Google LLC" and process.parent.code_signature.trusted == true)

Field Validations

Loading…

Comments (0)

Loading comments...