Query: alert when Detects browsers starting with the remote debugging flags. Which is a technique often used to perform browser injection
Matching passage: Sigma rule: Detects browsers starting with the remote debugging flags. Which is a technique often used to perform browser injection. Logsource: windows / process_creation. Rule: title: Browser Started with Remote Debugging id: b3d34dc5-2efd-4ae3-845f-8ec14921f449 related: - id: 3e8207c5-fcd2-4ea6-9418-15d45b4890e4 type: derived status: test description: Detects browsers starting with the remote debugging flags. Which is a technique often used to perform browser injection attacks references: - https://yoroi.company/wp-content/uploads/2022/05/EternityGroup_report_compressed.pdf - https://www.mdsec.co.uk/2022/10/analysing-lastpass-part-1/ - https://github.com/defaultnamehere/cookie_crimes/ - https://github.com/wunderwuzzi23/firefox-cookiemonster author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-07-27 modified: 2022-12-23 tags: - attack.credential-access - attack.collection - attack.t1185 logsource: category: process_creation product: windows detection: selection_chromium_based: CommandLine|contains: ' --remote-debugging-' selection_firefox: Image|endswith: \firefox.exe CommandLine|contains: ' -start-debugger-server' condition: 1 of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects an appx package that was added to the pipeline of the "to be processed" packages which was downloaded from a fil. Logsource: windows / appxdeployment-server. Rule: title: Remote AppX Package Downloaded from File Sharing or CDN Domain id: 8b48ad89-10d8-4382-a546-50588c410f0d related: - id: d635249d-86b5-4dad-a8c7-d7272b788586 type: similar - id: 52182dfb-afb7-41db-b4bc-5336cb29b464 type: similar - id: ae02ed70-11aa-4a22-b397-c0d0e8f6ea99 type: similar - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97 type: similar - id: 7b434893-c57d-4f41-908d-6a17bf1ae98f type: similar - id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c type: similar - id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794 type: similar - id: 56454143-524f-49fb-b1c6-3fb8b1ad41fb type: similar - id: b6e04788-29e1-4557-bb14-77f761848ab8 type: similar - id: a0d7e4d2-bede-4141-8896-bc6e237e977c type: similar - id: 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7 type: similar status: test description: 'Detects an appx package that was added to the pipeline of the "to be processed" packages which was downloaded from a file sharing or CDN domain. ' references: - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/ - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-11 modified: 2026-03-29 tags: - attack.stealth logsource: product: windows service: appxdeployment-server detection: selection: EventID: 854 Path|contains: - .githubusercontent.com - 0x0.st - anonfiles.com - bashupload.com - cdn.discordapp.com - chunk.io - ddns.net - dl.dropboxusercontent.com - ghostbin.co - github.com - glitch.me - gofile.io - hastebin.com - mediafire.com - mega.nz - onrender.com - pages.dev - paste.ee - pastebin.com - pastebin.pl - pastetext.net - privatlab.com - privatlab.net - send.exploit.in - sendspace.com - storage.googleapis.com - storjshare.io - supabase.co - temp.sh - transfer.sh - trycloudflare.com - ufile.io - w3spaces.com - workers.dev - x0.at condition: selection falsepositives: - Unlikely, unless the organization uses file sharing or CDN services to distribute internal applications. level: high