Hunting Malicious Chrome Extension
Query
// Hunting Malicious Chrome Extension
// A new attack campaign has targeted known Chrome browser extensions, leading to at least 16 extensions being compromised and exposing over 600,000 users to data exposure and credential theft.
// https://thehackernews.com/2024/12/16-chrome-extensions-hacked-exposing.html
// https://www.extensiontotal.com/cyberhaven-incident-live
// 11:08 UTC January 1st, 2025 - Total 36 malicious extensions
let MaliciousChromeExtensionID = dynamic(["emedckhdnioeieppmeojgegjfkhdlaeo","eaijffijbobmnonfhilihbejadplhddo","lbneaaedflankmgmfbmaplggbmjjmbae",
"hmiaoahjllhfgebflooeeefeiafpkfde","pdkmmfdfggfpibdjbbghggcllhhainjo","jiofmdifioeejeilfkpegipdjiopiekl",
"acmfnomgphggonodopogfbmkneepfgnh","hihblcmlaaademjlakdpicchbjnnnkbo","ndlbedplllcgconngcnfmkadhokfaaln",
"bibjgkidgpfbblifamdlkdlhgihmfohh","pkgciiiancapdlpcbppfkmeaieppikkk","epdjhgbipjpbbhoccdeipghoihibnfja",
"bbdnohkpnbkdkmnkddobeafboooinpla","befflofjcniongenjmbkgkoljhgliihe","cedgndijpacnfbdggppddacngjfdkaca",
"nnpnnpemnckcfdebeekibpiijlicmpom","dpggmcodlahmljkhlmpgpdcffdaoccni","cplhlgabfijoiabgkigdafklbhhdkahj",
"egmennebgadmncfjafcemlecimkepcle","mnhffkhmpnefgklngfmlndmkimimbphc","oaikpkmjciadfpddlpjjdapglcihgdle",
"fbmlcbhdmilaggedifpihjgkkmdgeljh","kkodiihpgodmdankclfibbiphjkfdenh","oeiomhmbaapihbilkfkhmlajkeegnjhe",
"igbodamhgjohafcenbcljfegbipdfjpk","bgejafhieobnfpjlpcjjggoboebonfcg","llimhhconnjiflfimocjggfjdlmlhblm",
"hodiladlefdpcbemnbbcpclbmknkiaem","epikoohpebngmakjinphfiagogjcnddm","pajkjnmeojmbapicmbpliphjmcekeaac",
"ogbhbgkiojdollpjbhbamafmedkeockb","eanofdhdfbcalhflpbdipkjjkoimeeod","ekpkdmohpdnebfedjjfklhpefgpgaaji",
"miglaibdlgminlepgeifekifakochlka","mbindhfolmpijhodmgkloeeppmkhpmhc","didhgeamncokiaegffipckhhcpnmlcbl",
"bibjgkidgpfbblifamdlkdlhgihmfohh","pkgciiiancapdlpcbppfkmeaieppikkk","epdjhgbipjpbbhoccdeipghoihibnfja",
"bbdnohkpnbkdkmnkddobeafboooinpla","befflofjcniongenjmbkgkoljhgliihe","cedgndijpacnfbdggppddacngjfdkaca",
"nnpnnpemnckcfdebeekibpiijlicmpom","dpggmcodlahmljkhlmpgpdcffdaoccni","cplhlgabfijoiabgkigdafklbhhdkahj",
"egmennebgadmncfjafcemlecimkepcle","mnhffkhmpnefgklngfmlndmkimimbphc","oaikpkmjciadfpddlpjjdapglcihgdle",
"fbmlcbhdmilaggedifpihjgkkmdgeljh","kkodiihpgodmdankclfibbiphjkfdenh","oeiomhmbaapihbilkfkhmlajkeegnjhe",
"igbodamhgjohafcenbcljfegbipdfjpk","bgejafhieobnfpjlpcjjggoboebonfcg","llimhhconnjiflfimocjggfjdlmlhblm",
"hodiladlefdpcbemnbbcpclbmknkiaem","epikoohpebngmakjinphfiagogjcnddm","pajkjnmeojmbapicmbpliphjmcekeaac",
"ogbhbgkiojdollpjbhbamafmedkeockb","eanofdhdfbcalhflpbdipkjjkoimeeod","ekpkdmohpdnebfedjjfklhpefgpgaaji",
"miglaibdlgminlepgeifekifakochlka","mbindhfolmpijhodmgkloeeppmkhpmhc"]);
DeviceFileEvents
| where ActionType == "FileCreated" and FileName endswith ".crx"
| where FileName has_any(MaliciousChromeExtensionID)
| where isnotempty(SHA1)Explanation
This query is designed to identify potentially malicious activities related to Chrome browser extensions on devices. Here's a simple breakdown of what it does:
-
Targeted Threat: It focuses on a specific threat where known Chrome extensions have been compromised, affecting a large number of users by exposing their data and credentials.
-
List of Malicious Extensions: It defines a list of known malicious Chrome extension IDs that are suspected to be involved in this threat.
-
Data Source: The query looks at device file events, specifically searching for files that have been created.
-
File Type: It filters for files with the ".crx" extension, which is the file type for Chrome extensions.
-
Malicious Check: It checks if the file name contains any of the IDs from the list of known malicious extensions.
-
Integrity Verification: It ensures that the file has a SHA1 hash, which is a way to verify the integrity and authenticity of the file.
In summary, this query is used to detect the creation of potentially harmful Chrome extensions on devices by matching them against a list of known malicious extension IDs and ensuring they have a valid hash for further investigation.
Details
Steven Lim
Released: January 3, 2025
Tables
Keywords
Operators