Detection proposal: Chromium remote debugging used for cookie theft
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
Start with the existing Headless Browser Usage analytic, which the issue says misses remote-debugging launches, and the Phemedrone Stealer story where the new analytics would go. Build the two proposed detections, one Anomaly on browser processes with a remote-debugging switch and one Hunting search on Sysmon EID 3 loopback connections to ports 9222-9229, then run contentctl-ng build. Done means the build passes and both analytics fire on the lab cases while staying silent on the negatives.
由索引模型根据 Issue 内容生成。
描述
Gap. After Chrome's App-Bound Encryption, infostealers (for example Phemedrone, per Elastic Security Labs) launch Chrome or Edge with --remote-debugging-port or --remote-debugging-pipe and a non-default --user-data-dir. They then read cookies through the DevTools Protocol, often headless or with the window placed off-screen. security_content has no analytic for --remote-debugging. The existing Headless Browser Usage analytic requires --headless AND --disable-gpu, and in my lab it missed every remote-debugging launch.
Proposal.
- Windows Chromium Browser Remote Debugging Enabled (Anomaly, Endpoint.Processes): browser main processes (Chrome, Edge, Brave, Opera, Vivaldi) started with a remote-debugging switch. Child processes and the elevated self-relaunch are excluded. Triage fields: debug_mode (fixed port, port 0, pipe), alt_profile and hidden.
- Windows Local Chromium DevTools Port Connection By Non-Browser Process (Hunting, Sysmon EID 3): a non-browser process initiating a loopback connection to ports 9222-9229.
Both would go under the existing Phemedrone Stealer story (T1539, T1185).
Evidence. Native Windows 11 with Edge 156, Chrome 156 and Sysmon 15.22, using empty temporary profiles. The DevTools endpoint answered on all three fixed-port cases. Results: Anomaly 5/5 with no hits on 2 negatives; Hunting 1/1. contentctl-ng build passes. Related: #4382, #4383 and the dMSA proposal.
- 主要语言
- Python
- 星标
- 1.7k
- 派生
- 507
- 平均合并
- 3 天 18 小时
- 30 天内合并 PR
- 36
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
splunk/security_content 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 65/100
splunk/security_content#4401 ·
维护者通常 1 天内回复
-
enhancement
难度 2/5 1-3 小时 新手友好度 72/100
splunk/security_content#4400 ·
维护者通常 1 天内回复
-
Detection proposal: VBA Stomping (T1564.007) - EvilClippy execution and vbaProject.bin creation by non-Office process可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 4/5 3-5 天 新手友好度 54/100
splunk/security_content#4405 ·
维护者通常 1 天内回复
-
bug
难度 4/5 3-5 天 新手友好度 42/100
splunk/security_content#4399 ·
维护者通常 1 天内回复
-
enhancement
难度 4/5 3-5 天 新手友好度 55/100
splunk/security_content#4393 · 3 条评论 ·
维护者通常 1 天内回复
查看 splunk/security_content 的全部 Issue
相似的 Issue
-
question
难度 1/5 1 小时以内 新手友好度 68/100
vllm-project/vime#524 ·
维护者通常 7 天内回复
-
WOPI editor page is scrollable by a few pixels, which breaks scrolling in the document (Firefox)未关闭
难度 2/5 1-3 小时 新手友好度 84/100
suitenumerique/drive#969 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 67/100
theupdateframework/python-tuf#3044 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 84/100
FAIRmat-NFDI/pynxtools#861 ·
-
难度 2/5 1-3 小时 新手友好度 76/100
NVIDIA/nsight-python#88 ·
维护者通常 1 天内回复