Query: alert when Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation
Matching passage: Sigma rule: Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation. Logsource: macos / process_creation. Rule: title: Suspicious Browser Child Process - MacOS id: 0250638a-2b28-4541-86fc-ea4c558fa0c6 status: test description: Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation. references: - https://fr.slideshare.net/codeblue_jp/cb19-recent-apt-attack-on-crypto-exchange-employees-by-heungsoo-kang - https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_initial_access_suspicious_browser_childproc.toml author: Sohan G (D4rkCiph3r) date: 2023-04-05 tags: - attack.initial-access - attack.execution - attack.t1189 - attack.t1203 - attack.t1059 logsource: category: process_creation product: macos detection: selection: ParentImage|contains: - com.apple.WebKit.WebContent - firefox - Google Chrome Helper - Google Chrome - Microsoft Edge - Opera - Safari - Tor Browser Image|endswith: - /bash - /curl - /dash - /ksh - /osascript - /perl - /php - /pwsh - /python - /sh - /tcsh - /wget - /zsh filter_main_generic: CommandLine|contains: --defaults-torrc filter_main_ms_autoupdate: CommandLine|contains: /Library/Application Support/Microsoft/MAU*/Microsoft AutoUpdate.app/Contents/MacOS/msupdate filter_main_chrome: ParentImage|contains: - Google Chrome Helper - Google Chrome CommandLine|contains: - /Volumes/Google Chrome/Google Chrome.app/Contents/Frameworks/*/Resources/install.sh - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/*/Resources/keystone_promote_preflight.sh - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/*/Resources/keystone_promote_postflight.sh filter_main_ms_edge: ParentImage|contains: Microsoft Edge CommandLine|contains: - IOPlatformExpertDevice - hw.model filter_main_chromerecovery: ParentImage|contains: - Google Chrome Helper - Google Chrome CommandLine|contains|all: - /Users/ - /Library/Application Support/Google/Chrome/recovery/ - /ChromeRecovery filter_optional_null: CommandLine: null filter_optional_empty: CommandLine: '' condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate browser install, update and recovery scripts level: medium
Near-miss passage: Sigma rule: Detects applications being added to the "allowed applications" list of exploit guard in order to bypass controlled folde. Logsource: windows / registry_set. Rule: title: Suspicious Application Allowed Through Exploit Guard id: 42205c73-75c8-4a63-9db1-e3782e06fda0 status: test description: Detects applications being added to the "allowed applications" list of exploit guard in order to bypass controlled folder settings references: - https://www.microsoft.com/security/blog/2017/10/23/windows-defender-exploit-guard-reduce-the-attack-surface-against-next-generation-malware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection_key: TargetObject|contains: SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications selection_paths: TargetObject|contains: - \Users\Public\ - \AppData\Local\Temp\ - \Desktop\ - \PerfLogs\ - \Windows\Temp\ condition: all of selection_* falsepositives: - Unlikely level: high