Query: detection rule: Running Chrome VPN Extensions via the Registry install 2 vpn extension
Matching passage: Sigma rule: Running Chrome VPN Extensions via the Registry install 2 vpn extension. Logsource: windows / registry_set. Rule: title: Running Chrome VPN Extensions via the Registry 2 VPN Extension id: b64a026b-8deb-4c1d-92fd-98893209dff1 status: test description: Running Chrome VPN Extensions via the Registry install 2 vpn extension references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1133/T1133.md#atomic-test-1---running-chrome-vpn-extensions-via-the-registry-2-vpn-extension author: frack113 date: 2021-12-28 modified: 2023-08-17 tags: - attack.initial-access - attack.persistence - attack.t1133 logsource: category: registry_set product: windows detection: chrome_ext: TargetObject|contains: Software\Wow6432Node\Google\Chrome\Extensions TargetObject|endswith: update_url chrome_vpn: TargetObject|contains: - fdcgdnkidjaadafnichfpabhfomcebme - fcfhplploccackoneaefokcmbjfbkenj - bihmplhobchoageeokmgbdihknkjbknd - gkojfkhlekighikafcpjkiklfbnlmeio - jajilbjjinjmgcibalaakngmkilboobh - gjknjjomckknofjidppipffbpoekiipm - nabbmpekekjknlbkgpodfndbodhijjem - kpiecbcckbofpmkkkdibbllpinceiihk - nlbejmccbhkncgokjcmghpfloaajcffj - omghfjlpggmjjaagoclmmobgdodcjboh - bibjcjfmgapbfoljiojpipaooddpkpai - mpcaainmfjjigeicjnlkdfajbioopjko - jljopmgdobloagejpohpldgkiellmfnc - lochiccbgeohimldjooaakjllnafhaid - nhnfcgpcbfclhfafjlooihdfghaeinfc - ookhnhpkphagefgdiemllfajmkdkcaim - namfblliamklmeodpcelkokjbffgmeoo - nbcojefnccbanplpoffopkoepjmhgdgh - majdfhpaihoncoakbjgbdhglocklcgno - lnfdmdhmfbimhhpaeocncdlhiodoblbd - eppiocemhmnlbhjplcgkofciiegomcon - cocfojppfigjeefejbpfmedgjbpchcng - foiopecknacmiihiocgdjgbjokkpkohc - hhdobjgopfphlmjbmnpglhfcgppchgje - jgbaghohigdbgbolncodkdlpenhcmcge - inligpkjkhbpifecbdjhmdpcfhnlelja - higioemojdadgdbhbbbkfbebbdlfjbip - hipncndjamdcmphkgngojegjblibadbe - iolonopooapdagdemdoaihahlfkncfgg - nhfjkakglbnnpkpldhjmpmmfefifedcj - jpgljfpmoofbmlieejglhonfofmahini - fgddmllnllkalaagkghckoinaemmogpe - ejkaocphofnobjdedneohbbiilggdlbi - keodbianoliadkoelloecbhllnpiocoi - hoapmlpnmpaehilehggglehfdlnoegck - poeojclicodamonabcabmapamjkkmnnk - dfkdflfgjdajbhocmfjolpjbebdkcjog - kcdahmgmaagjhocpipbodaokikjkampi - klnkiajpmpkkkgpgbogmcgfjhdoljacg - lneaocagcijjdpkcabeanfpdbmapcjjg - pgfpignfckbloagkfnamnolkeaecfgfh - jplnlifepflhkbkgonidnobkakhmpnmh - jliodmnojccaloajphkingdnpljdhdok - hnmpcagpplmpfojmgmnngilcnanddlhb - ffbkglfijbcbgblgflchnbphjdllaogb - kcndmbbelllkmioekdagahekgimemejo - jdgilggpfmjpbodmhndmhojklgfdlhob - bihhflimonbpcfagfadcnbbdngpopnjb - ppajinakbfocjfnijggfndbdmjggcmde - oofgbpoabipfcfjapgnbbjjaenockbdp
Near-miss passage: Sigma rule: Detects powershell scripts that adds a Name Resolution Policy Table (NRPT) rule for the specified namespace. This will b. Logsource: windows / ps_script. Rule: title: Powershell Add Name Resolution Policy Table Rule id: 4368354e-1797-463c-bc39-a309effbe8d7 status: test description: 'Detects powershell scripts that adds a Name Resolution Policy Table (NRPT) rule for the specified namespace. This will bypass the default DNS server and uses a specified server for answering the query. ' references: - https://twitter.com/NathanMcNulty/status/1569497348841287681 - https://learn.microsoft.com/en-us/powershell/module/dnsclient/add-dnsclientnrptrule?view=windowsserver2022-ps author: Borna Talebi date: 2021-09-14 modified: 2022-10-09 tags: - attack.impact - attack.t1565 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Add-DnsClientNrptRule - -Namesp - -NameSe condition: selection falsepositives: - Unknown level: high