## 6 Analysis of Post-Exploitation Behavior and Defense Mechanisms
Furthermore, shortcuts placed in C:\Users\%USERNAME%\Desktop grant the respective user full control. While administrators can implement restrictions limiting user access to read and execute permissions for these shortcuts, this approach remains susceptible to circumvention. Critically, both tested browsers functioned successfully in headless mode. This capability, coupled with Task Scheduler, enables autonomous communication with a C2 server, eliminating the need for user interaction. One approach to detecting the execution of malicious shortcut files involves creating an event viewer within Active Directory to monitor Task Scheduler activity in real time. An alternative method, detailed in the pseudocode presented in Listing 2, outlines a YARA rule designed to identify suspicious Task Scheduler entries that utilize shortcut files to execute Chrome or MSEdge. ```
1:Input: Task Scheduler XML files, Registry exports
2:Output: Detection of suspicious scheduled tasks
3:Initialize taskexecutes_lnk\(\leftarrow\) search for scthtasks /Create /TN ''*.lnk''
4:Initialize chrome_exec\(\leftarrow\) search for C:\(\backslash\). *\chrome.exe Initialize edge_exec\(\leftarrow\) search for C:\(\backslash\). *\(\backslash\)msege.exe
5:Initialize hnk_exec\(\leftarrow\) search for C:\(\backslash\)*.lnk Initialize suspicious_flags\(\leftarrow\) search for -headless, -disable-web-security, -remote-debugging-port
6:if taskexecutes_lnk AND (chrome_exec OR edge_exec)then
7:Report suspicious scheduled task
8:elseif lnk_exec AND (chrome_exec OR edge_exec)then  Report suspicious shortcut execution
9:elseif suspicious_flags detected then  Report potentially malicious browser execution
10:endif
11:End
```  
**Algorithm 2** Detection of scheduled tasks executing \"*.lnk\" shortcuts that launch Chrome or Edge. To mitigate the risk of portable Chrome or MSEdge execution, the YARA rule in Listing 3 can be implemented for detection. This rule specifically targets Chrome and MSEdge executables located in common portable application paths. Naturally, while these YARA rules are not infallible, they offer a degree of mitigation. Specifically, they may necessitate more sophisticated evasion techniques from attackers in certain scenarios. Furthermore, AppLocker and Windows Defender Application Control (WDAC) can contribute to mitigating this attack. Both are native Windows security features designed to regulate application and script execution. They enable organizations to enforce application control policies, reduce attack surfaces, and mitigate malware. Specifically, AppLocker, available in Windows Enterprise and Education editions, empowers administrators to define allowed and disallowed applications and scripts. It supports application control through various rules and file types. WDAC offers a more advanced and contemporary approach to application control compared to AppLocker. Its enhanced security posture stems from enforcing strict application control policies at the kernel level, enabling pre-execution policy enforcement. ```
Input:Running processes, Task Scheduler, Registry, Startup Entries Output:Detection of suspicious portable browser execution
3:Initialize chromte_portable_paths \(\leftarrow\) search for: C:\Users\. *\Downloads\chrome.exe C:\Users\. *\Desktop\chrome.exe C:\Users\. *\AppData\LocalTemp\chrome.exe C:\Users\. *\PortableApps\ChromePortable\chrome.exe Initialize edge_portable_paths \(\leftarrow\) search for: C:\Users\. *\Downloads\msglee.exe C:\Users\. *\Desktop\msglee.exe C:\Users\. *\AppData\LocalTemp\msglee.exe C:\Users\. *\PortableApps\EdgePortable\msglee.exe Initialize suspicious_flags \(\leftarrow\) search for: -no-sandbox, -disable-web-security, -headless, -remote-debugging-port
6:if chromte_portable_paths OR edge_portable_paths detected then  Report execution of portable browser else if suspicious_flags detected then  Report potentially malicious browser execution end if  End
```  
**Listing 3** Detect Portable Execution of Chrome or Edge.