Chrome — CraftedSignal Threat Feed

Chromium Use-After-Free Vulnerability in ANGLE (CVE-2026-7359)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:40 +0000

CVE-2026-7359 describes a use-after-free vulnerability present in ANGLE (Almost Native Graphics Layer Engine), a crucial component of the Chromium open-source project. This vulnerability impacts applications that utilize the Chromium engine, most notably Google Chrome and Microsoft Edge. While the provided source does not give specific exploitation details, use-after-free vulnerabilities can allow for arbitrary code execution. Google Chrome has already addressed this vulnerability, and Microsoft Edge has incorporated the fix from Chromium. This vulnerability matters to defenders because successful exploitation could lead to compromise of the browser and potentially the underlying system.

Attack Chain

An attacker crafts a malicious web page containing JavaScript code that leverages a flaw in ANGLE’s memory management.
A user visits the malicious web page through Chrome or Edge.
The JavaScript code triggers the use-after-free vulnerability by freeing a memory object in ANGLE and then attempting to access it again.
This memory corruption leads to a controlled crash or allows the attacker to overwrite memory with arbitrary data.
The attacker leverages the memory overwrite to inject malicious code into the browser process.
The injected code executes within the context of the browser, granting the attacker access to user data, cookies, and other sensitive information.
The attacker may then use this access to perform actions on behalf of the user, such as stealing credentials, installing malware, or spreading the attack to other systems.
The attacker achieves arbitrary code execution on the user’s system, potentially leading to full system compromise.

Impact

A successful exploit of CVE-2026-7359 could allow an attacker to execute arbitrary code within the context of the affected browser (Chrome or Edge). This can lead to sensitive information disclosure, data theft, and potentially full system compromise. The scope of impact is broad, affecting any user who visits a malicious webpage while using a vulnerable version of Chrome or Edge. Since Chrome and Edge are widely used, this vulnerability poses a significant risk.

Recommendation

Deploy the Sigma rule Detect Suspicious WebGL Usage to identify potential exploitation attempts targeting ANGLE via WebGL.
Monitor web server logs for suspicious requests (cs-uri-query) that may be related to the exploitation of CVE-2026-7359.
Ensure that all Chrome and Edge installations are updated to the latest versions to patch CVE-2026-7359.

CVE-2026-7339: Heap Buffer Overflow in WebRTC

hello@craftedsignal.io — Fri, 01 May 2026 02:21:27 +0000

CVE-2026-7339 is a critical heap buffer overflow vulnerability affecting the WebRTC (Web Real-Time Communication) component in Google Chrome and Microsoft Edge (Chromium-based). This vulnerability stems from improper memory management within WebRTC, potentially allowing a remote attacker to execute arbitrary code by crafting malicious web content. As Microsoft Edge ingests Chromium, it is also vulnerable. Users of Chrome and Edge are affected. Defenders should apply available patches promptly to mitigate potential exploitation.

Attack Chain

An attacker crafts a malicious website designed to trigger the WebRTC vulnerability.
The victim visits the malicious website using a vulnerable version of Chrome or Edge.
The website uses JavaScript to initiate a WebRTC session.
The crafted WebRTC data triggers a heap buffer overflow during memory allocation within the WebRTC component.
The overflow overwrites adjacent memory regions on the heap.
The attacker carefully crafts the overflow data to overwrite critical program data or function pointers.
The corrupted data leads to arbitrary code execution within the context of the browser process.
The attacker gains control of the user’s browser and potentially the underlying system.

Impact

Successful exploitation of CVE-2026-7339 can lead to arbitrary code execution, allowing an attacker to potentially install malware, steal sensitive information, or take control of the affected system. Given the widespread use of Chrome and Edge, this vulnerability could impact a large number of users across various sectors, including individuals, businesses, and government organizations.

Recommendation

Apply the latest security updates for Google Chrome and Microsoft Edge (Chromium-based) to patch CVE-2026-7339.
Deploy the Sigma rule “Detect WebRTC Heap Overflow Attempt” to identify potential exploitation attempts targeting CVE-2026-7339.
Monitor web server logs for unusual requests or patterns associated with WebRTC usage that could indicate exploitation attempts.

Chromium Use-After-Free Vulnerability in Media Component (CVE-2026-7355)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:27 +0000

CVE-2026-7355 is a critical use-after-free vulnerability residing in the Media component of the Chromium browser engine. This vulnerability affects Google Chrome and Microsoft Edge, as Edge incorporates Chromium. A use-after-free vulnerability occurs when an application attempts to use memory after it has been freed, which can lead to crashes, arbitrary code execution, or other unexpected behavior. Successful exploitation could allow an attacker to execute arbitrary code within the context of the browser. This vulnerability was reported and patched by the Chromium project.

Attack Chain

An attacker crafts a malicious webpage containing specially crafted media content.
A user opens the malicious webpage in a vulnerable version of Chrome or Edge.
The browser attempts to process the malicious media content, triggering the use-after-free vulnerability in the Media component.
The vulnerable code attempts to access a freed memory region.
The attacker gains control of the memory region due to the use-after-free condition.
The attacker injects malicious code into the controlled memory region.
The browser executes the attacker-controlled code.
The attacker achieves arbitrary code execution within the context of the browser process, potentially leading to system compromise.

Impact

Successful exploitation of CVE-2026-7355 can lead to arbitrary code execution within the context of the browser process. An attacker could potentially gain control of the user’s system, steal sensitive information, or install malware. Given the widespread use of Chrome and Edge, a successful exploit could impact a large number of users across various sectors.

Recommendation

Apply the latest security updates for Google Chrome and Microsoft Edge to patch CVE-2026-7355.
Deploy the Sigma rule “Detect Chromium Use-After-Free in Media Component” to identify potential exploitation attempts.
Enable process creation logging to capture events related to potential exploitation attempts, facilitating detection rule functionality.

Chromium Use-After-Free Vulnerability in GPU Component (CVE-2026-7357)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:27 +0000

CVE-2026-7357 is a critical use-after-free vulnerability residing within the GPU component of the Chromium rendering engine. This flaw directly impacts Google Chrome and, due to Microsoft Edge’s reliance on Chromium, also affects Edge users. A remote attacker could potentially exploit this vulnerability to execute arbitrary code on a targeted system. The vulnerability stems from improper memory management within the GPU processing routines. While the specific exploitation details are not provided in this brief, successful exploitation generally involves crafting malicious web content to trigger the vulnerability during GPU operations.

Attack Chain

Attacker crafts a malicious HTML page containing JavaScript that triggers specific GPU functions.
User visits the malicious website using Chrome or Edge.
The browser’s rendering engine processes the malicious JavaScript, leading to the allocation and subsequent freeing of a memory region in the GPU component.
The attacker’s JavaScript code then attempts to access the previously freed memory region, triggering the use-after-free vulnerability.
By manipulating the memory layout, the attacker can overwrite the freed memory with controlled data.
The overwritten memory is later accessed by the GPU, leading to the execution of attacker-controlled code.
The attacker gains arbitrary code execution within the context of the browser process.
The attacker leverages the code execution to escalate privileges or perform other malicious activities.

Impact

Successful exploitation of CVE-2026-7357 can lead to arbitrary code execution on the victim’s machine. The attacker could potentially install malware, steal sensitive data, or take control of the affected system. Given the widespread use of Chrome and Edge, this vulnerability poses a significant risk to a large number of users.

Recommendation

Apply the latest security updates for Google Chrome to address CVE-2026-7357.
Apply the latest security updates for Microsoft Edge to address CVE-2026-7357.
Deploy the Sigma rule “Detect Suspicious WebAssembly Execution” to identify potential exploitation attempts involving WebAssembly.

Chromium Use-After-Free Vulnerability in GPU Component (CVE-2026-7333)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:27 +0000

CVE-2026-7333 is a critical use-after-free vulnerability residing in the GPU component of the Chromium browser engine. This flaw allows an attacker to potentially corrupt memory and execute arbitrary code in the context of the browser process. As Microsoft Edge is built upon the Chromium engine, it is also susceptible to this vulnerability. Public details are limited, but exploitation likely involves crafting malicious web content that triggers the use-after-free condition within the GPU processing routines. This vulnerability poses a significant threat as it could allow attackers to compromise user systems simply by visiting a malicious website.

Attack Chain

Attacker crafts a malicious HTML page containing JavaScript that interacts with the GPU functionality of the browser.
The user visits the malicious page via a phishing email or drive-by download.
The JavaScript code triggers the use-after-free vulnerability in the Chromium GPU component.
The vulnerability allows the attacker to corrupt memory allocated for GPU processing.
The attacker manipulates memory to gain control of program execution.
The attacker injects malicious code into the browser process.
The injected code executes with the privileges of the browser process, allowing the attacker to perform actions such as stealing cookies, credentials, or installing malware.
The attacker gains persistent access to the compromised system and exfiltrates sensitive data.

Impact

A successful exploitation of CVE-2026-7333 could allow an attacker to execute arbitrary code on a user’s system. This could lead to the theft of sensitive information, installation of malware, or complete system compromise. Given the widespread use of Chromium-based browsers such as Chrome and Edge, this vulnerability has the potential to affect millions of users. The impact is considered critical due to the ease of exploitation and the potential for widespread damage.

Recommendation

Apply the latest security updates for Google Chrome and Microsoft Edge to patch CVE-2026-7333.
Deploy the Sigma rule “Detect Suspicious GPU Process Creation” to identify potential exploitation attempts.
Enable process creation logging with command-line arguments to detect suspicious processes spawned by the browser (logsource: process_creation).

Chromium Use-After-Free Vulnerability in Codecs (CVE-2026-7348)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:27 +0000

CVE-2026-7348 is a critical use-after-free vulnerability residing within the Codecs component of the Chromium browser engine. This vulnerability affects applications that utilize the Chromium engine, most notably Google Chrome and Microsoft Edge. While the specific details of the vulnerability are documented in Google Chrome Releases, the underlying issue stems from improper memory management within the Codecs library. Successful exploitation could allow an attacker to execute arbitrary code within the context of the affected browser, potentially leading to data theft, system compromise, or other malicious activities. This vulnerability requires immediate attention from organizations utilizing Chrome or Edge.

Attack Chain

An attacker crafts a malicious web page containing specially crafted media content designed to trigger the use-after-free condition in the Codecs library.
The user visits the malicious web page using Google Chrome or Microsoft Edge.
The browser attempts to process the malicious media content, triggering the vulnerable code path within the Codecs library.
The use-after-free condition is triggered when the browser attempts to access memory that has already been freed.
The attacker leverages the use-after-free condition to corrupt memory and gain control of program execution.
The attacker injects and executes arbitrary code within the context of the browser process.
The attacker gains unauthorized access to sensitive data, such as cookies, credentials, or browsing history.
The attacker potentially escalates privileges or installs malware on the user’s system.

Impact

Successful exploitation of CVE-2026-7348 allows an attacker to execute arbitrary code within the context of the affected browser (Chrome or Edge). This can lead to sensitive information disclosure, such as credentials or browsing history. The attacker could potentially gain full control of the user’s system. Given the widespread use of Chromium-based browsers, a successful exploit could impact a significant number of users across various sectors.

Recommendation

Upgrade Google Chrome to the latest version that addresses this vulnerability; refer to Google Chrome Releases.
Ensure Microsoft Edge is updated to the latest version incorporating the Chromium security patch.
Deploy the Sigma rule “Detect Chromium Codecs Use-After-Free Exploit Attempt” to identify potential exploitation attempts via webserver logs.
Enable webserver logging to capture HTTP requests, which is required for the provided Sigma rule.

Chromium Use-After-Free Vulnerability in Cast (CVE-2026-7349)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:27 +0000

CVE-2026-7349 is a use-after-free vulnerability found in the Cast component of the Chromium browser engine. This vulnerability affects Google Chrome and, by extension, Microsoft Edge, as Edge is built upon Chromium. Use-after-free vulnerabilities can allow an attacker to execute arbitrary code or cause a denial-of-service. While the original report comes from Chrome, the nature of Chromium’s shared codebase means that other Chromium-based browsers are also vulnerable. Successful exploitation of this vulnerability could lead to code execution within the context of the browser process. Defenders need to prioritize patching and monitoring for unusual browser behavior.

Attack Chain

An attacker crafts a malicious webpage designed to trigger the use-after-free vulnerability in the Cast component.
The user visits the malicious webpage using a vulnerable version of Chrome or Edge.
The Cast component attempts to access a freed memory location.
The attacker exploits the use-after-free condition to corrupt memory.
The attacker overwrites a function pointer or other critical data structure in memory.
The attacker triggers the execution of the corrupted function pointer or data structure.
The attacker gains arbitrary code execution within the context of the browser process.
The attacker could potentially escalate privileges or perform other malicious activities, such as installing malware or stealing sensitive data.

Impact

Successful exploitation of CVE-2026-7349 could allow an attacker to execute arbitrary code within the context of the browser, potentially leading to data theft, malware installation, or further system compromise. Given the widespread use of Chrome and Edge, this vulnerability has a significant impact. The specific number of potential victims is dependent on the speed of patching, but could potentially affect millions of users.

Recommendation

Apply the latest security updates for Google Chrome and Microsoft Edge to patch CVE-2026-7349.
Deploy the Sigma rules provided in this brief to your SIEM to detect potential exploitation attempts.
Monitor browser process execution for unexpected code loading or memory access patterns using process creation logs.
Implement memory protection techniques such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) to mitigate the impact of successful exploitation.

Chromium Use-After-Free Vulnerability in Cast (CVE-2026-7338)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:27 +0000

CVE-2026-7338 is a critical use-after-free vulnerability residing within the Cast component of the Chromium browser engine. Google Chrome and Microsoft Edge (Chromium-based) are both affected by this flaw. While the provided source does not specify the exact vulnerable versions, it indicates that Microsoft Edge ingests Chromium, and thus is affected by vulnerabilities addressed in Chromium releases. Successful exploitation of this vulnerability could lead to arbitrary code execution in the context of the user running the browser. This poses a significant risk, as attackers could potentially gain control of the user’s system. Defenders should prioritize patching affected browsers.

Attack Chain

An attacker crafts a malicious webpage or injects malicious code into a legitimate website that utilizes the Cast functionality.
The victim visits the malicious website or interacts with the compromised legitimate website using an affected browser (Chrome or Edge).
The malicious webpage triggers the use-after-free vulnerability in the Cast component.
The vulnerability allows the attacker to access memory that has already been freed.
The attacker overwrites the freed memory with attacker-controlled data.
The attacker manipulates the memory layout to redirect program execution.
The browser attempts to execute code from the attacker-controlled memory location.
This results in arbitrary code execution within the context of the browser process.

Impact

Successful exploitation of CVE-2026-7338 allows an attacker to execute arbitrary code on a victim’s machine. This can lead to complete system compromise, data theft, installation of malware, or other malicious activities. Given the widespread use of Chromium-based browsers like Chrome and Edge, this vulnerability has the potential to impact a large number of users across various sectors. The severity is critical due to the potential for remote code execution.

Recommendation

Apply the latest security updates for Google Chrome to address CVE-2026-7338 as detailed in Google Chrome Releases.
Apply the latest security updates for Microsoft Edge (Chromium-based) to address CVE-2026-7338, ensuring the ingested Chromium version contains the fix.
Deploy the Sigma rules provided in this brief to your SIEM to detect potential exploitation attempts targeting the Cast component.
Enable enhanced browser security features, such as sandboxing and site isolation, to limit the impact of potential exploits.

Chromium Heap Buffer Overflow Vulnerability (CVE-2026-7353)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:27 +0000

CVE-2026-7353 is a critical heap buffer overflow vulnerability residing within the Skia graphics library, a core component of the Chromium open-source project. This vulnerability impacts applications that utilize Chromium, including Google Chrome and Microsoft Edge. While the specific details of exploitation are not provided in this brief, the nature of a heap buffer overflow suggests a high potential for arbitrary code execution. Successful exploitation could allow an attacker to gain control of the affected browser process. Given the widespread use of Chromium-based browsers, this vulnerability poses a significant risk to a large user base. Defenders should prioritize patching and consider implementing mitigations to detect and prevent potential exploitation attempts.

Attack Chain

An attacker crafts a malicious web page or injects malicious content into a trusted website.
The victim visits the malicious web page or interacts with the injected content using a Chromium-based browser (Chrome or Edge).
The browser’s rendering engine, utilizing the Skia library, processes the malicious content, triggering the heap buffer overflow in Skia.
The overflow allows the attacker to overwrite adjacent memory regions in the heap.
By carefully crafting the overflowed data, the attacker can overwrite critical data structures within the browser process.
The attacker gains control of the execution flow by overwriting function pointers or other control data.
The attacker executes arbitrary code within the context of the browser process.
The attacker could then perform actions such as installing malware, stealing sensitive data, or further compromising the system.

Impact

Successful exploitation of CVE-2026-7353 allows for arbitrary code execution within the context of the affected browser process. This can lead to a complete compromise of the user’s browser session, potentially enabling the attacker to steal credentials, inject malicious code into other websites, or install malware on the victim’s system. Given the widespread use of Chrome and Edge, the potential impact is significant, affecting potentially millions of users.

Recommendation

Apply the latest security updates for Google Chrome and Microsoft Edge to patch CVE-2026-7353.
Deploy the following Sigma rule to detect potential exploitation attempts based on suspicious process execution originating from the browser (see “Detect Suspicious Process Creation from Browser”).
Enable enhanced browser security features such as site isolation to mitigate the impact of successful exploitation.

Multiple Vulnerabilities in Google Chrome

hello@craftedsignal.io — Thu, 30 Apr 2026 09:09:14 +0000

Multiple unspecified vulnerabilities have been identified in Google Chrome. An attacker exploiting these vulnerabilities could potentially execute arbitrary code, circumvent security measures, expose and manipulate sensitive information, and trigger a denial-of-service condition. The specifics of these vulnerabilities, including CVE identifiers, are not detailed in the source document. The lack of detail makes it difficult to determine the scope of the attack, but successful exploitation could lead to significant compromise of systems running Chrome. Defenders should prioritize monitoring for suspicious activity within Chrome processes.

Attack Chain

An attacker identifies a vulnerable version of Google Chrome.
The attacker crafts a malicious web page or injects malicious code into a legitimate website.
A user visits the malicious web page or a compromised legitimate website using Google Chrome.
The attacker exploits a vulnerability in Chrome, such as a use-after-free or buffer overflow.
Successful exploitation allows the attacker to execute arbitrary code within the context of the Chrome process.
The attacker leverages the code execution to bypass security mechanisms like sandboxing.
The attacker gains access to sensitive data, such as cookies, browsing history, or credentials.
The attacker manipulates data or causes a denial-of-service condition by crashing the browser or consuming excessive resources.

Impact

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, bypass security mechanisms, disclose and manipulate data, and cause a denial-of-service condition. The impact ranges from data theft and credential compromise to complete system takeover, depending on the specific vulnerability and the attacker’s objectives. While the exact number of potential victims is unknown, the widespread use of Chrome makes this a high-impact threat.

Recommendation

Monitor process creation events for suspicious child processes spawned by chrome.exe, especially those involving command-line interpreters or scripting engines. Use the “Detect Suspicious Child Process of Chrome” Sigma rule.
Inspect network connections originating from chrome.exe for unusual destinations or protocols. Deploy the “Detect Outbound Connection from Chrome without User Interaction” Sigma rule.
Implement web content filtering to block access to known malicious websites that might attempt to exploit Chrome vulnerabilities.

Detection of Command and Control Activity via Commonly Abused Web Services

hello@craftedsignal.io — Thu, 04 Jan 2024 12:00:00 +0000

Adversaries may implement command and control (C2) communications that use common web services to hide their activity. This attack technique is typically targeted at an organization and uses web services common to the victim network, which allows the adversary to blend into legitimate traffic activity. These popular services are typically targeted since they have most likely been used before compromise, which helps malicious traffic blend in. This detection focuses on identifying connections from Windows hosts to a predefined list of commonly abused web services from processes running outside of typical program installation directories, indicating a potential C2 channel leveraging legitimate services. The rule aims to detect this behavior by monitoring network connections and DNS requests originating from unusual locations.

Attack Chain

Initial access is achieved via an unknown method (e.g., phishing, exploit).
Malware is installed on the victim’s system, likely outside typical program directories.
The malware establishes a DNS connection to a commonly abused web service (e.g., pastebin.com, raw.githubusercontent.com) to obscure C2 traffic.
The malware sends encrypted or encoded commands to the web service.
The web service acts as an intermediary, relaying the commands to the attacker’s C2 server.
The C2 server responds with instructions, which are then relayed back to the compromised host through the same web service.
The malware executes the received commands, potentially leading to data exfiltration, lateral movement, or other malicious activities.
The attacker maintains persistent access and control over the compromised system using the web service as a hidden C2 channel.

Impact

Successful exploitation can lead to data theft, system compromise, and further propagation within the network. Since commonly used web services are utilized, the malicious activity can blend in with legitimate network traffic, making it difficult to detect. The impact can range from minor data breaches to complete network compromise, depending on the attacker’s objectives and the level of access gained.

Recommendation

Deploy the Sigma rule Detect Commonly Abused Web Services via DNS to your SIEM to identify suspicious DNS queries to known C2 web services originating from anomalous processes.
Enable DNS query logging on Windows endpoints to provide the data source required for the Sigma rule.
Review network connection logs for processes outside standard installation directories communicating with domains listed in the query section of the Sigma rule to identify potential C2 activity.
Implement network segmentation to limit the potential impact of compromised hosts.

Browser Process Spawned from an Unusual Parent

hello@craftedsignal.io — Wed, 03 Jan 2024 18:15:00 +0000

This detection identifies instances where a browser process, specifically Google Chrome or Microsoft Edge, is initiated from an unexpected parent process on a Windows system. The rule focuses on scenarios where browsers are launched with arguments indicative of remote debugging, headless automation, or minimal user interaction. Such activity can signal an attempt to manipulate a browser session for malicious purposes, potentially leading to credential theft or unauthorized access to sensitive information. The rule is designed to leverage data from Elastic Defend, Microsoft Defender XDR, SentinelOne Cloud Funnel, Sysmon, and Windows Process Creation Logs.

Attack Chain

An attacker gains initial access to a Windows system (e.g., via phishing or exploiting a vulnerability).
The attacker executes a script or command to launch a browser process (chrome.exe or msedge.exe).
The browser is launched with specific command-line arguments, such as --remote-debugging-port, --headless, or --window-position=-x,-y, to enable remote control or hide the browser window.
The parent process of the browser is an unusual executable, not typically associated with launching browsers (e.g., not explorer.exe).
The attacker leverages the remote debugging port to interact with the browser session programmatically.
The attacker attempts to steal credentials or session cookies from the browser.
The attacker uses stolen credentials to access sensitive data.

Impact

Successful exploitation can lead to the theft of user credentials, enabling unauthorized access to sensitive data and systems. This could result in financial loss, data breaches, and reputational damage for affected organizations. The targeted use of browser manipulation techniques increases the likelihood of bypassing traditional security controls.

Recommendation

Deploy the Sigma rule Browser Process Spawned from Unusual Parent to your SIEM and tune for your environment.
Enable Sysmon process-creation logging (Event ID 1) to collect the necessary data for the Sigma rule.
Investigate any alerts generated by the Browser Process Spawned from Unusual Parent Sigma rule.
Review process command lines for arguments like --remote-debugging-port or --headless to identify potential browser manipulation attempts.
Monitor network connections originating from browser processes for unexpected destinations, as described in the investigation guide from the source.

Detection of Command and Control Activity via Common Web Services

hello@craftedsignal.io — Wed, 03 Jan 2024 15:00:00 +0000

This detection rule, sourced from Elastic, identifies potential command and control (C2) activity by detecting connections to commonly abused web services. Adversaries often leverage popular web services like pastebin, GitHub, Dropbox, and Discord to mask malicious communications within legitimate network traffic. This technique makes it challenging for defenders to distinguish between normal user activity and malicious C2 traffic. The rule focuses on Windows systems and monitors DNS queries to identify processes communicating with a predefined list of services known to be abused by attackers. The rule was last updated on 2026-05-04 and is designed to work with data from Elastic Defend and SentinelOne Cloud Funnel. The goal is to identify anomalous network connections originating from unusual processes.

Attack Chain

A user on a Windows host unknowingly executes a malicious file (e.g., via phishing or drive-by download).
The malicious file executes a process outside of typical program directories (e.g., C:\Windows\Temp).
This process initiates a DNS query to a domain associated with a commonly abused web service (e.g., pastebin.com, githubusercontent.com).
The DNS query resolves to an IP address, and a network connection is established to the web service.
The malicious process uploads or downloads data from the web service, potentially containing commands for the compromised host or exfiltrated data.
The web service acts as an intermediary, relaying commands from the attacker to the compromised host or exfiltrated data from the compromised host to the attacker.
The attacker uses the C2 channel to perform further actions on the compromised host, such as lateral movement or data theft.

Impact

A successful attack using common web services for C2 can lead to data exfiltration, system compromise, and further propagation within the network. The low severity suggests a focus on detecting early-stage C2 activity, which if left unchecked, could escalate into a significant incident. The usage of popular web services makes detection difficult, requiring careful analysis and tuning to avoid false positives.

Recommendation

Deploy the Sigma rule “Connection to Commonly Abused Web Services” to your SIEM and tune it for your environment to minimize false positives.
Enable Sysmon DNS query logging to accurately capture DNS requests for improved detection capabilities, activating the “DNS Query to Commonly Abused Web Services” rule.
Investigate any alerts generated by this rule, focusing on the process execution chain and network connections to determine the legitimacy of the activity, referencing the investigation steps described in the rule documentation.
Review and update the list of excluded processes in the Sigma rule to reflect your organization’s approved software and reduce false positives.

Kerberos Traffic from Unusual Process

hello@craftedsignal.io — Wed, 03 Jan 2024 14:00:00 +0000

This detection identifies unusual processes initiating network connections to the standard Kerberos port (88) on Windows systems. Typically, the lsass.exe process handles Kerberos traffic on domain-joined hosts. The rule aims to detect processes other than lsass.exe communicating with the Kerberos port, which could indicate malicious activity such as Kerberoasting (T1558.003) or Pass-the-Ticket (T1550.003). The detection is designed to work with data from Elastic Defend and SentinelOne Cloud Funnel. This can help security teams identify potential credential access attempts and lateral movement within the network.

Attack Chain

An attacker compromises a user account or system within the domain.
The attacker executes a malicious binary or script (e.g., PowerShell) on the compromised system.
The malicious process attempts to request Kerberos service tickets (TGS) for various services within the domain. This is done by connecting to the Kerberos port (88) on a domain controller.
The attacker uses tools like Rubeus or Kerberoast.ps1 to enumerate and request TGS tickets.
The unusual process (not lsass.exe) sends Kerberos traffic to the domain controller.
The attacker extracts the Kerberos tickets from memory or network traffic.
The attacker cracks the offline TGS tickets to obtain service account passwords (Kerberoasting).
The attacker uses the compromised service account credentials to move laterally within the network or access sensitive data.

Impact

A successful Kerberoasting or Pass-the-Ticket attack can lead to unauthorized access to sensitive resources and lateral movement within the network. Attackers can compromise service accounts with elevated privileges, potentially leading to domain-wide compromise. Detection of this behavior can prevent attackers from gaining access to critical assets. While the exact number of victims and sectors targeted are unknown, this technique is widely used by various threat actors in targeted attacks.

Recommendation

Deploy the “Kerberos Traffic from Unusual Process” Sigma rule to your SIEM and tune for your environment. Enable network connection logging to capture the necessary traffic.
Investigate any alerts triggered by the Sigma rule, focusing on the process execution chain and potential malicious binaries.
Review event ID 4769 for suspicious ticket requests as mentioned in the rule’s documentation.
Examine host services for suspicious entries as outlined in the original Elastic detection rule using Osquery.
Monitor for processes connecting to port 88, filtering out legitimate Kerberos clients like lsass.exe, using the “Detect Kerberos Traffic from Non-Standard Process” Sigma rule.
Investigate processes identified by the rule and compare them to the list of legitimate processes to identify unauthorized connections to the Kerberos port.

Unauthorized Access to Chrome Local State File

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This threat brief focuses on detecting unauthorized access to the Chrome ‘Local State’ file, a critical component of the Chrome browser that stores settings and, more importantly, the encrypted master key used to protect saved passwords. The ‘Local State’ file is typically accessed only by the Chrome browser itself. When other processes attempt to read this file, it’s a strong indicator of malicious activity, potentially involving credential theft or reconnaissance by malware such as RedLine Stealer. This analytic leverages Windows Security Event logs, specifically event code 4663, to identify this behavior. Detecting and responding to this activity is crucial for preventing attackers from gaining access to sensitive user credentials stored within the Chrome browser.

Attack Chain

The attacker gains initial access to the system, often through phishing or exploitation of a software vulnerability (not specified in this advisory).
Malware is deployed on the victim machine (e.g., RedLine Stealer).
The malware attempts to locate the Chrome ‘Local State’ file, typically found at *\\AppData\\Local\\Google\\Chrome\\User Data\\Local State.
The malware process accesses the ‘Local State’ file, triggering a Windows Security Event 4663.
The malware extracts the encrypted master key from the ‘Local State’ file.
The malware decrypts the master key using attacker-controlled methods.
The decrypted master key is used to decrypt saved passwords stored by Chrome.
The stolen credentials are exfiltrated to the attacker’s command and control server.

Impact

Successful exploitation allows attackers to steal user credentials stored in the Chrome browser. This can lead to unauthorized access to email accounts, social media profiles, banking websites, and other sensitive online services. The impact could range from identity theft and financial fraud to corporate espionage and data breaches. The number of potential victims depends on the number of systems compromised and the extent of Chrome usage on those systems.

Recommendation

Enable “Audit Object Access” in Group Policy and configure auditing for both “Success” and “Failure” events to ensure Windows Security Event 4663 is generated for file access, as described in the “how_to_implement” section.
Deploy the Sigma rule “Detect Chrome Local State File Access by Non-Chrome Processes” to your SIEM to detect unauthorized access attempts (see “rules” section). Tune the rule’s filter list to reduce false positives related to legitimate software uninstallers.
Investigate any alerts generated by the Sigma rule, focusing on identifying the process name and path involved in accessing the ‘Local State’ file, as described in the rule’s description.
Consider implementing network egress filtering to prevent exfiltration of stolen credentials to known malicious command and control servers.

RMM Domain DNS Queries from Non-Browser Processes

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This detection identifies potentially malicious use of Remote Monitoring and Management (RMM) tools by detecting DNS queries to known RMM domains originating from processes that are not web browsers. Attackers frequently abuse legitimate RMM software for command and control, persistence, and lateral movement within compromised networks. This rule focuses on surfacing RMM clients, scripts, or other non-browser activity contacting these services, thereby increasing the likelihood of detecting unauthorized remote access or malicious activity. The rule aims to reduce false positives by excluding common browser processes and focusing on unusual network activity. The identified domains are associated with various RMM tools like TeamViewer, AnyDesk, and ScreenConnect. This detection is relevant for organizations concerned about insider threats, supply chain attacks, or general compromise leading to unauthorized remote access.

Attack Chain

An attacker gains initial access to a system, possibly through phishing or exploiting a vulnerability.
The attacker installs an unauthorized RMM tool (e.g., using a script or installer).
The RMM tool initiates a DNS query to resolve its command and control domain (e.g., teamviewer.com).
The system, now running the RMM agent, establishes a connection to the attacker-controlled RMM server.
The attacker uses the RMM tool to execute commands on the compromised system.
The attacker uses the RMM tool for lateral movement within the network.
The attacker uses the RMM tool to maintain persistence on the compromised system.

Impact

Compromise via unauthorized RMM tools can provide attackers with persistent remote access, enabling them to perform a range of malicious activities, including data theft, ransomware deployment, and further lateral movement within the network. Successful exploitation can lead to significant financial loss, reputational damage, and disruption of business operations. The number of affected systems can vary depending on the scope of the initial compromise and the attacker’s ability to move laterally.

Recommendation

Deploy the Sigma rule RMM Domain DNS Queries from Non-Browser Processes to your SIEM and tune it to your environment, excluding legitimate non-browser processes that use RMM tools.
Investigate any alerts generated by the rule, focusing on identifying the process making the DNS query and its parent process, as outlined in the rule’s description.
Monitor DNS query logs for queries to the RMM domains listed in the IOC table, and block them at the DNS resolver if unauthorized RMM use is confirmed.
Enable Sysmon Event ID 22 (DNS Query) logging to provide the necessary data for this detection, as recommended in the “Setup” section of the content.

Non-Chrome Process Accessing Chrome Login Data

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This threat brief focuses on detecting unauthorized access to Chrome’s “Login Data” file, a local SQLite database that stores user credentials. Attackers, after gaining initial access to a Windows system, may attempt to steal these credentials by directly accessing and parsing this file. The “Login Data” file contains sensitive information, including usernames, passwords, and URLs. The technique is commonly associated with credential-stealing malware families like RedLine Stealer, DarkGate, and others listed below. Successful exploitation allows attackers to harvest credentials for lateral movement and further compromise. This detection is based on Windows Security Event logs, specifically event ID 4663, which records attempts to access objects like files.

Attack Chain

The attacker gains initial access to the target system, potentially through phishing or exploiting a software vulnerability.
The attacker executes a malicious executable or script on the compromised system.
The malicious process attempts to access the Chrome “Login Data” file, typically located at *\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data.
Windows Security Event Log generates an event with EventCode 4663, recording the file access attempt.
The attacker’s process reads the “Login Data” SQLite database.
The attacker extracts and potentially decrypts stored usernames and passwords from the “Login Data” file.
The attacker uses the stolen credentials for lateral movement within the network.
The attacker achieves their final objective, such as data exfiltration or ransomware deployment.

Impact

Compromised Chrome “Login Data” files can lead to widespread credential theft, granting attackers unauthorized access to numerous online accounts. Depending on the user’s browsing habits and password reuse, this can include access to sensitive corporate resources, financial accounts, and personal email. The impact can range from financial loss to significant data breaches and reputational damage. The references section in the original source mentions Redline Stealer which is used in various attacks, indicating a potentially large number of victims across different sectors.

Recommendation

Enable “Audit Object Access” in Group Policy and configure auditing for both “Success” and “Failure” events to generate Windows Security Event 4663, as described in the “how_to_implement” section.
Deploy the Sigma rule Chrome Login Data Accessed by Non-Browser Process to your SIEM and tune the process_path filter to exclude legitimate software in your environment.
Investigate any alerts generated by the Chrome Login Data Accessed by Non-Browser Process Sigma rule to determine if credential theft has occurred and remediate any affected accounts.

DNS-over-HTTPS Enabled via Registry Modification

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

The use of DNS-over-HTTPS (DoH) can obscure network activity, potentially allowing malicious actors to bypass traditional DNS monitoring and conceal data exfiltration. When DoH is enabled, visibility into DNS query types, responses, and originating IPs is lost, hindering the detection of malicious activity. This behavior is detected by monitoring registry modifications associated with enabling DoH in popular browsers such as Microsoft Edge, Google Chrome, and Mozilla Firefox. The registry keys targeted are associated with settings that force the browsers to use secure DNS resolution, potentially circumventing organizational security policies.

Attack Chain

Initial Access: An attacker gains initial access to a Windows system through various means, such as phishing or exploiting a software vulnerability.
Privilege Escalation (if necessary): The attacker may need to escalate privileges to modify registry settings.
Defense Evasion: The attacker modifies the Windows registry to enable DNS-over-HTTPS (DoH) in web browsers like Edge, Chrome, or Firefox. This is achieved by modifying specific registry keys such as HKLM\SOFTWARE\Policies\Microsoft\Edge\BuiltInDnsClientEnabled, HKLM\SOFTWARE\Google\Chrome\DnsOverHttpsMode, or HKLM\SOFTWARE\Policies\Mozilla\Firefox\DNSOverHTTPS.
Obfuscation: By enabling DoH, the attacker encrypts DNS queries, making it difficult for network monitoring tools to inspect DNS traffic.
Command and Control: The attacker establishes command and control (C2) communication with a remote server over encrypted DNS traffic, evading traditional network-based detection methods.
Data Exfiltration: The attacker uses the encrypted DNS channel to exfiltrate sensitive data, bypassing network security controls that rely on DNS inspection.
Persistence (Optional): The attacker might establish persistence by ensuring the DoH settings remain enabled across system reboots.

Impact

Successful exploitation leads to a loss of visibility into DNS traffic, hindering incident response and threat hunting efforts. Attackers can effectively hide command-and-control communications and data exfiltration activities. Although this activity by itself isn’t inherently malicious, it removes a layer of defense, increasing the risk that malicious activities will go undetected.

Recommendation

Deploy the Sigma rules provided in this brief to your SIEM to detect the enabling of DNS-over-HTTPS via registry modifications.
Enable Sysmon registry event logging to capture the necessary events for the provided Sigma rules to function effectively.
Review and update security policies to ensure DNS-over-HTTPS is only enabled through approved channels and for legitimate purposes, reducing the risk of misuse, and create exceptions in the detection rule for systems where this is a known requirement.
Investigate any alerts generated by the Sigma rules, focusing on identifying the user account, process, and associated network activity (reference the investigation guide in the source URL).

CVE-2026-7337 Type Confusion Vulnerability in Chromium V8 Engine

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

CVE-2026-7337 is a type confusion vulnerability residing within the V8 JavaScript engine, the core component of Chromium-based browsers. This vulnerability impacts Google Chrome and Microsoft Edge (Chromium-based), as Edge incorporates the Chromium project. The vulnerability stems from improper handling of object types within the V8 engine during JavaScript execution, potentially leading to exploitable conditions. Successful exploitation could allow an attacker to execute arbitrary code within the context of the browser. Public details are available via the Google Chrome Releases blog and the Microsoft Security Response Center (MSRC). Defenders should prioritize patching to the latest available versions of Chrome and Edge.

Attack Chain

An attacker crafts a malicious web page containing JavaScript code designed to trigger the type confusion vulnerability in the V8 engine.
The victim visits the malicious web page using a vulnerable version of Google Chrome or Microsoft Edge.
The browser’s V8 engine attempts to execute the attacker-controlled JavaScript code.
Due to the type confusion vulnerability, the V8 engine misinterprets the type of a JavaScript object.
This misinterpretation leads to memory corruption within the browser process.
The attacker leverages the memory corruption to overwrite critical data structures within the browser’s memory space.
The attacker gains control of the browser process’s execution flow.
The attacker executes arbitrary code on the victim’s machine within the security context of the browser process, potentially leading to information disclosure, data theft, or further system compromise.

Impact

Successful exploitation of CVE-2026-7337 allows an attacker to execute arbitrary code within the context of the user’s browser. This could lead to sensitive information being stolen, such as cookies, browsing history, and stored credentials. Attackers could also potentially use this vulnerability to install malware or gain further access to the victim’s system. Given the widespread use of Chromium-based browsers, this vulnerability poses a significant threat to a large number of users.

Recommendation

Apply the latest security updates for Google Chrome to address CVE-2026-7337. Refer to the Google Chrome Releases blog for details.
Apply the latest security updates for Microsoft Edge (Chromium-based) to address CVE-2026-7337 as described in the MSRC advisory.
Implement a web proxy with content filtering to block access to known malicious websites that may attempt to exploit this vulnerability.

Masquerading Business Application Installers

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

Attackers often attempt to trick users into downloading and executing malicious executables by disguising them as legitimate business applications. This tactic is used to bypass security measures and gain initial access to a system. These malicious executables, often distributed via malicious ads, forum posts, and tutorials, mimic the names of commonly used applications such as Slack, WebEx, Teams, Discord, and Zoom. The executables are typically unsigned or signed with invalid certificates to further evade detection. This allows the attacker to execute arbitrary code on the victim’s machine, potentially leading to further compromise. This campaign aims to target end-users who are less security-aware, and this makes social engineering attacks like this very effective.

Attack Chain

The user visits a compromised website or clicks on a malicious advertisement.
The user is prompted to download an installer file masquerading as a legitimate business application (e.g., Slack, Zoom, Teams) from a download directory.
The downloaded executable is placed in the user’s Downloads folder (e.g., C:\Users*\Downloads*).
The user executes the downloaded file.
The executable, lacking a valid code signature, begins execution.
The malicious installer may drop and execute additional malware components.
The malware establishes persistence, potentially using techniques such as registry key modification.
The malware performs malicious activities, such as data exfiltration or lateral movement.

Impact

Successful execution of a masqueraded business application installer can lead to a complete system compromise. The attacker gains initial access and can deploy various malware payloads, including ransomware, keyloggers, and data stealers. This can result in data breaches, financial loss, and reputational damage. Although the specific number of victims and sectors targeted are not detailed, the widespread use of the applications being spoofed (Slack, Zoom, etc.) suggests a broad potential impact.

Recommendation

Implement the Sigma rule Potential Masquerading as Business App Installer to detect unsigned executables resembling legitimate business applications in download directories.
Enable process creation logging to capture the execution of unsigned executables.
Educate users on the risks of downloading and executing files from untrusted sources.
Implement application whitelisting to restrict the execution of unauthorized applications.
Regularly update endpoint detection and response (EDR) tools to detect and prevent the execution of known malware.
Monitor process execution events for processes originating from the Downloads folder that lack valid code signatures.