attack.t1176

Red Canary has had success detecting ChromeLoader by looking for instances of NW.js applications that are unsigned and running from %AppData/Roaming%. This behavior is not unique to ChromeLoader, and some tuning may be required to avoid detecting legitimate applications. A partial list of common ChromeLoader NW.js runtime app installation paths is included below to help distinguish the signal from the noise. Part of the RedCanary 2024 Threat Detection Report.

Web Browser Loading Extension

Mar 26, 2024 · attack.persistence attack.t1176 ·

Share on:

During execution, SmashJacker forced Google Chrome or Microsoft Edge to open with the command line argument --load-extension so a browser extension can install without user interaction. This analytic will likely uncover additional adware in an environment and may need tuning to take account for acceptable software installation. Part of the RedCanary 2024 Threat Detection Report.

Chrome Spawned by Powershell with Load-Extension in Command Line

Nov 9, 2022 · attack.persistence attack.t1176 ·

Share on:

Detects instances of the Chrome browser executable spawning from PowerShell with a corresponding command line that includes appdata\local as a parameter.