attack.t1176

ChromeLoader Malware Execution

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.t1059.001 attack.t1176 detection.emerging-threats ·

Share on:

Detects execution of ChromeLoader malware via a registered scheduled task

ChromeLoader Malware Detection

Aug 10, 2024 · attack.execution attack.T1059.001 attack.persistence attack.T1176 attack.T1053.005 ·

Share on:

Detects execution of ChromeLoader malware via a registered scheduled task

ChromeLoader NW.js Runtime App Installation Paths

Mar 26, 2024 · attack.persistence attack.t1176 ·

Share on:

Red Canary has had success detecting ChromeLoader by looking for instances of NW.js applications that are unsigned and running from %AppData/Roaming%. This behavior is not unique to ChromeLoader, and some tuning may be required to avoid detecting legitimate applications. A partial list of common ChromeLoader NW.js runtime app installation paths is included below to help distinguish the signal from the noise. Part of the RedCanary 2024 Threat Detection Report.

Web Browser Loading Extension

Mar 26, 2024 · attack.persistence attack.t1176 ·

Share on:

During execution, SmashJacker forced Google Chrome or Microsoft Edge to open with the command line argument --load-extension so a browser extension can install without user interaction. This analytic will likely uncover additional adware in an environment and may need tuning to take account for acceptable software installation. Part of the RedCanary 2024 Threat Detection Report.

Chrome Spawned by Powershell with Load-Extension in Command Line

Nov 9, 2022 · attack.persistence attack.t1176 ·

Share on:

Detects instances of the Chrome browser executable spawning from PowerShell with a corresponding command line that includes appdata\local as a parameter.