Detection proposal: Chromium remote debugging used for cookie theft

Abierto
  • ¿Algo no está bien?
#4,389 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
30/100
Tipo de issue
Nueva funcionalidad
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
python
Área
security

Línea de trabajo

Start with the existing Headless Browser Usage analytic, which the issue says misses remote-debugging launches, and the Phemedrone Stealer story where the new analytics would go. Build the two proposed detections, one Anomaly on browser processes with a remote-debugging switch and one Hunting search on Sysmon EID 3 loopback connections to ports 9222-9229, then run contentctl-ng build. Done means the build passes and both analytics fire on the lab cases while staying silent on the negatives.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

enhancement

Gap. After Chrome's App-Bound Encryption, infostealers (for example Phemedrone, per Elastic Security Labs) launch Chrome or Edge with --remote-debugging-port or --remote-debugging-pipe and a non-default --user-data-dir. They then read cookies through the DevTools Protocol, often headless or with the window placed off-screen. security_content has no analytic for --remote-debugging. The existing Headless Browser Usage analytic requires --headless AND --disable-gpu, and in my lab it missed every remote-debugging launch.

Proposal.

  • Windows Chromium Browser Remote Debugging Enabled (Anomaly, Endpoint.Processes): browser main processes (Chrome, Edge, Brave, Opera, Vivaldi) started with a remote-debugging switch. Child processes and the elevated self-relaunch are excluded. Triage fields: debug_mode (fixed port, port 0, pipe), alt_profile and hidden.
  • Windows Local Chromium DevTools Port Connection By Non-Browser Process (Hunting, Sysmon EID 3): a non-browser process initiating a loopback connection to ports 9222-9229.

Both would go under the existing Phemedrone Stealer story (T1539, T1185).

Evidence. Native Windows 11 with Edge 156, Chrome 156 and Sysmon 15.22, using empty temporary profiles. The DevTools endpoint answered on all three fixed-port cases. Results: Anomaly 5/5 with no hits on 2 negatives; Hunting 1/1. contentctl-ng build passes. Related: #4382, #4383 and the dMSA proposal.

Lenguaje dominante
Python
Estrellas
1.7k
Forks
505
Merge medio
3 d 17 h
PR fusionados (30 d)
39

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de splunk/security_content

Todos los issues de splunk/security_content

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.