Detection proposal: Chromium remote debugging used for cookie theft
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 30/100
Research direction
Start with the existing Headless Browser Usage analytic, which the issue says misses remote-debugging launches, and the Phemedrone Stealer story where the new analytics would go. Build the two proposed detections, one Anomaly on browser processes with a remote-debugging switch and one Hunting search on Sysmon EID 3 loopback connections to ports 9222-9229, then run contentctl-ng build. Done means the build passes and both analytics fire on the lab cases while staying silent on the negatives.
Written by the indexing model from the issue text.
Description
Gap. After Chrome's App-Bound Encryption, infostealers (for example Phemedrone, per Elastic Security Labs) launch Chrome or Edge with --remote-debugging-port or --remote-debugging-pipe and a non-default --user-data-dir. They then read cookies through the DevTools Protocol, often headless or with the window placed off-screen. security_content has no analytic for --remote-debugging. The existing Headless Browser Usage analytic requires --headless AND --disable-gpu, and in my lab it missed every remote-debugging launch.
Proposal.
- Windows Chromium Browser Remote Debugging Enabled (Anomaly, Endpoint.Processes): browser main processes (Chrome, Edge, Brave, Opera, Vivaldi) started with a remote-debugging switch. Child processes and the elevated self-relaunch are excluded. Triage fields: debug_mode (fixed port, port 0, pipe), alt_profile and hidden.
- Windows Local Chromium DevTools Port Connection By Non-Browser Process (Hunting, Sysmon EID 3): a non-browser process initiating a loopback connection to ports 9222-9229.
Both would go under the existing Phemedrone Stealer story (T1539, T1185).
Evidence. Native Windows 11 with Edge 156, Chrome 156 and Sysmon 15.22, using empty temporary profiles. The DevTools endpoint answered on all three fixed-port cases. Results: Anomaly 5/5 with no hits on 2 negatives; Hunting 1/1. contentctl-ng build passes. Related: #4382, #4383 and the dMSA proposal.
- Dominant language
- Python
- Stars
- 1.7k
- Forks
- 507
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 35
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from splunk/security_content
-
bug
Difficulty 1/5 Under an hour Newbie friendliness 78/100
splunk/security_content#4418 ·
Maintainers usually reply within 1 day
-
[BUG] Windows New EventLog ChannelAccess Registry Value Set: second path has single backslashesOpenbug
Difficulty 1/5 1-3 hours Newbie friendliness 78/100
splunk/security_content#4417 ·
Maintainers usually reply within 1 day
-
[BUG]Linux Change File Owner To Root: detection bypass using "chown root: <file>"Possibly taken @thegreatmhn claimed this 1 day ago. Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
splunk/security_content#4413 · 4 comments ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
splunk/security_content#4401 ·
Maintainers usually reply within 1 day
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
splunk/security_content#4400 ·
Maintainers usually reply within 1 day
All issues in splunk/security_content
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
deepchem/deepchem#5289 · 1 comment ·
Maintainers usually reply within 2 days
-
Difficulty 1/5 Under an hour Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 60/100
UKGovernmentBEIS/inspect_evals#2892 · 1 comment ·
Maintainers usually reply within 1 day
-
Versioning docs: say that no output from the 0.46 warning check means nothing is affectedPossibly taken @grelinfo claimed this today. Opendocumentation priority:low size:S
Difficulty 1/5 Under an hour Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
alphacrack/readme2demo#293 ·