Query: Sigma rule for Running Chrome VPN Extensions via the Registry install 2 vpn extension
Matching passage: Sigma rule: Running Chrome VPN Extensions via the Registry install 2 vpn extension. Logsource: windows / registry_set. Rule: title: Running Chrome VPN Extensions via the Registry 2 VPN Extension id: b64a026b-8deb-4c1d-92fd-98893209dff1 status: test description: Running Chrome VPN Extensions via the Registry install 2 vpn extension references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1133/T1133.md#atomic-test-1---running-chrome-vpn-extensions-via-the-registry-2-vpn-extension author: frack113 date: 2021-12-28 modified: 2023-08-17 tags: - attack.initial-access - attack.persistence - attack.t1133 logsource: category: registry_set product: windows detection: chrome_ext: TargetObject|contains: Software\Wow6432Node\Google\Chrome\Extensions TargetObject|endswith: update_url chrome_vpn: TargetObject|contains: - fdcgdnkidjaadafnichfpabhfomcebme - fcfhplploccackoneaefokcmbjfbkenj - bihmplhobchoageeokmgbdihknkjbknd - gkojfkhlekighikafcpjkiklfbnlmeio - jajilbjjinjmgcibalaakngmkilboobh - gjknjjomckknofjidppipffbpoekiipm - nabbmpekekjknlbkgpodfndbodhijjem - kpiecbcckbofpmkkkdibbllpinceiihk - nlbejmccbhkncgokjcmghpfloaajcffj - omghfjlpggmjjaagoclmmobgdodcjboh - bibjcjfmgapbfoljiojpipaooddpkpai - mpcaainmfjjigeicjnlkdfajbioopjko - jljopmgdobloagejpohpldgkiellmfnc - lochiccbgeohimldjooaakjllnafhaid - nhnfcgpcbfclhfafjlooihdfghaeinfc - ookhnhpkphagefgdiemllfajmkdkcaim - namfblliamklmeodpcelkokjbffgmeoo - nbcojefnccbanplpoffopkoepjmhgdgh - majdfhpaihoncoakbjgbdhglocklcgno - lnfdmdhmfbimhhpaeocncdlhiodoblbd - eppiocemhmnlbhjplcgkofciiegomcon - cocfojppfigjeefejbpfmedgjbpchcng - foiopecknacmiihiocgdjgbjokkpkohc - hhdobjgopfphlmjbmnpglhfcgppchgje - jgbaghohigdbgbolncodkdlpenhcmcge - inligpkjkhbpifecbdjhmdpcfhnlelja - higioemojdadgdbhbbbkfbebbdlfjbip - hipncndjamdcmphkgngojegjblibadbe - iolonopooapdagdemdoaihahlfkncfgg - nhfjkakglbnnpkpldhjmpmmfefifedcj - jpgljfpmoofbmlieejglhonfofmahini - fgddmllnllkalaagkghckoinaemmogpe - ejkaocphofnobjdedneohbbiilggdlbi - keodbianoliadkoelloecbhllnpiocoi - hoapmlpnmpaehilehggglehfdlnoegck - poeojclicodamonabcabmapamjkkmnnk - dfkdflfgjdajbhocmfjolpjbebdkcjog - kcdahmgmaagjhocpipbodaokikjkampi - klnkiajpmpkkkgpgbogmcgfjhdoljacg - lneaocagcijjdpkcabeanfpdbmapcjjg - pgfpignfckbloagkfnamnolkeaecfgfh - jplnlifepflhkbkgonidnobkakhmpnmh - jliodmnojccaloajphkingdnpljdhdok - hnmpcagpplmpfojmgmnngilcnanddlhb - ffbkglfijbcbgblgflchnbphjdllaogb - kcndmbbelllkmioekdagahekgimemejo - jdgilggpfmjpbodmhndmhojklgfdlhob - bihhflimonbpcfagfadcnbbdngpopnjb - ppajinakbfocjfnijggfndbdmjggcmde - oofgbpoabipfcfjapgnbbjjaenockbdp
Near-miss passage: Sigma rule: Detects suspicious network connections made by a well-known Windows binary run with no command line parameters. Logsource: windows / network_connection. Rule: title: Suspicious Network Connection Binary No CommandLine id: 20384606-a124-4fec-acbb-8bd373728613 status: test description: Detects suspicious network connections made by a well-known Windows binary run with no command line parameters references: - https://redcanary.com/blog/raspberry-robin/ author: Florian Roth (Nextron Systems) date: 2022-07-03 tags: - attack.stealth logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: - \regsvr32.exe - \rundll32.exe - \dllhost.exe CommandLine|endswith: - \regsvr32.exe - \rundll32.exe - \dllhost.exe filter_no_cmdline: CommandLine: '' filter_null: CommandLine: null condition: selection and not 1 of filter* falsepositives: - Unknown level: high