Edge — CraftedSignal Threat Feed

Chromium Use-After-Free Vulnerability in ANGLE (CVE-2026-7359)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:40 +0000

CVE-2026-7359 describes a use-after-free vulnerability present in ANGLE (Almost Native Graphics Layer Engine), a crucial component of the Chromium open-source project. This vulnerability impacts applications that utilize the Chromium engine, most notably Google Chrome and Microsoft Edge. While the provided source does not give specific exploitation details, use-after-free vulnerabilities can allow for arbitrary code execution. Google Chrome has already addressed this vulnerability, and Microsoft Edge has incorporated the fix from Chromium. This vulnerability matters to defenders because successful exploitation could lead to compromise of the browser and potentially the underlying system.

Attack Chain

An attacker crafts a malicious web page containing JavaScript code that leverages a flaw in ANGLE’s memory management.
A user visits the malicious web page through Chrome or Edge.
The JavaScript code triggers the use-after-free vulnerability by freeing a memory object in ANGLE and then attempting to access it again.
This memory corruption leads to a controlled crash or allows the attacker to overwrite memory with arbitrary data.
The attacker leverages the memory overwrite to inject malicious code into the browser process.
The injected code executes within the context of the browser, granting the attacker access to user data, cookies, and other sensitive information.
The attacker may then use this access to perform actions on behalf of the user, such as stealing credentials, installing malware, or spreading the attack to other systems.
The attacker achieves arbitrary code execution on the user’s system, potentially leading to full system compromise.

Impact

A successful exploit of CVE-2026-7359 could allow an attacker to execute arbitrary code within the context of the affected browser (Chrome or Edge). This can lead to sensitive information disclosure, data theft, and potentially full system compromise. The scope of impact is broad, affecting any user who visits a malicious webpage while using a vulnerable version of Chrome or Edge. Since Chrome and Edge are widely used, this vulnerability poses a significant risk.

Recommendation

Deploy the Sigma rule Detect Suspicious WebGL Usage to identify potential exploitation attempts targeting ANGLE via WebGL.
Monitor web server logs for suspicious requests (cs-uri-query) that may be related to the exploitation of CVE-2026-7359.
Ensure that all Chrome and Edge installations are updated to the latest versions to patch CVE-2026-7359.

CVE-2026-7339: Heap Buffer Overflow in WebRTC

hello@craftedsignal.io — Fri, 01 May 2026 02:21:27 +0000

CVE-2026-7339 is a critical heap buffer overflow vulnerability affecting the WebRTC (Web Real-Time Communication) component in Google Chrome and Microsoft Edge (Chromium-based). This vulnerability stems from improper memory management within WebRTC, potentially allowing a remote attacker to execute arbitrary code by crafting malicious web content. As Microsoft Edge ingests Chromium, it is also vulnerable. Users of Chrome and Edge are affected. Defenders should apply available patches promptly to mitigate potential exploitation.

Attack Chain

An attacker crafts a malicious website designed to trigger the WebRTC vulnerability.
The victim visits the malicious website using a vulnerable version of Chrome or Edge.
The website uses JavaScript to initiate a WebRTC session.
The crafted WebRTC data triggers a heap buffer overflow during memory allocation within the WebRTC component.
The overflow overwrites adjacent memory regions on the heap.
The attacker carefully crafts the overflow data to overwrite critical program data or function pointers.
The corrupted data leads to arbitrary code execution within the context of the browser process.
The attacker gains control of the user’s browser and potentially the underlying system.

Impact

Successful exploitation of CVE-2026-7339 can lead to arbitrary code execution, allowing an attacker to potentially install malware, steal sensitive information, or take control of the affected system. Given the widespread use of Chrome and Edge, this vulnerability could impact a large number of users across various sectors, including individuals, businesses, and government organizations.

Recommendation

Apply the latest security updates for Google Chrome and Microsoft Edge (Chromium-based) to patch CVE-2026-7339.
Deploy the Sigma rule “Detect WebRTC Heap Overflow Attempt” to identify potential exploitation attempts targeting CVE-2026-7339.
Monitor web server logs for unusual requests or patterns associated with WebRTC usage that could indicate exploitation attempts.

Chromium Use-After-Free Vulnerability in Media Component (CVE-2026-7355)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:27 +0000

CVE-2026-7355 is a critical use-after-free vulnerability residing in the Media component of the Chromium browser engine. This vulnerability affects Google Chrome and Microsoft Edge, as Edge incorporates Chromium. A use-after-free vulnerability occurs when an application attempts to use memory after it has been freed, which can lead to crashes, arbitrary code execution, or other unexpected behavior. Successful exploitation could allow an attacker to execute arbitrary code within the context of the browser. This vulnerability was reported and patched by the Chromium project.

Attack Chain

An attacker crafts a malicious webpage containing specially crafted media content.
A user opens the malicious webpage in a vulnerable version of Chrome or Edge.
The browser attempts to process the malicious media content, triggering the use-after-free vulnerability in the Media component.
The vulnerable code attempts to access a freed memory region.
The attacker gains control of the memory region due to the use-after-free condition.
The attacker injects malicious code into the controlled memory region.
The browser executes the attacker-controlled code.
The attacker achieves arbitrary code execution within the context of the browser process, potentially leading to system compromise.

Impact

Successful exploitation of CVE-2026-7355 can lead to arbitrary code execution within the context of the browser process. An attacker could potentially gain control of the user’s system, steal sensitive information, or install malware. Given the widespread use of Chrome and Edge, a successful exploit could impact a large number of users across various sectors.

Recommendation

Apply the latest security updates for Google Chrome and Microsoft Edge to patch CVE-2026-7355.
Deploy the Sigma rule “Detect Chromium Use-After-Free in Media Component” to identify potential exploitation attempts.
Enable process creation logging to capture events related to potential exploitation attempts, facilitating detection rule functionality.

Chromium Use-After-Free Vulnerability in GPU Component (CVE-2026-7357)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:27 +0000

CVE-2026-7357 is a critical use-after-free vulnerability residing within the GPU component of the Chromium rendering engine. This flaw directly impacts Google Chrome and, due to Microsoft Edge’s reliance on Chromium, also affects Edge users. A remote attacker could potentially exploit this vulnerability to execute arbitrary code on a targeted system. The vulnerability stems from improper memory management within the GPU processing routines. While the specific exploitation details are not provided in this brief, successful exploitation generally involves crafting malicious web content to trigger the vulnerability during GPU operations.

Attack Chain

Attacker crafts a malicious HTML page containing JavaScript that triggers specific GPU functions.
User visits the malicious website using Chrome or Edge.
The browser’s rendering engine processes the malicious JavaScript, leading to the allocation and subsequent freeing of a memory region in the GPU component.
The attacker’s JavaScript code then attempts to access the previously freed memory region, triggering the use-after-free vulnerability.
By manipulating the memory layout, the attacker can overwrite the freed memory with controlled data.
The overwritten memory is later accessed by the GPU, leading to the execution of attacker-controlled code.
The attacker gains arbitrary code execution within the context of the browser process.
The attacker leverages the code execution to escalate privileges or perform other malicious activities.

Impact

Successful exploitation of CVE-2026-7357 can lead to arbitrary code execution on the victim’s machine. The attacker could potentially install malware, steal sensitive data, or take control of the affected system. Given the widespread use of Chrome and Edge, this vulnerability poses a significant risk to a large number of users.

Recommendation

Apply the latest security updates for Google Chrome to address CVE-2026-7357.
Apply the latest security updates for Microsoft Edge to address CVE-2026-7357.
Deploy the Sigma rule “Detect Suspicious WebAssembly Execution” to identify potential exploitation attempts involving WebAssembly.

Chromium Use-After-Free Vulnerability in GPU Component (CVE-2026-7333)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:27 +0000

CVE-2026-7333 is a critical use-after-free vulnerability residing in the GPU component of the Chromium browser engine. This flaw allows an attacker to potentially corrupt memory and execute arbitrary code in the context of the browser process. As Microsoft Edge is built upon the Chromium engine, it is also susceptible to this vulnerability. Public details are limited, but exploitation likely involves crafting malicious web content that triggers the use-after-free condition within the GPU processing routines. This vulnerability poses a significant threat as it could allow attackers to compromise user systems simply by visiting a malicious website.

Attack Chain

Attacker crafts a malicious HTML page containing JavaScript that interacts with the GPU functionality of the browser.
The user visits the malicious page via a phishing email or drive-by download.
The JavaScript code triggers the use-after-free vulnerability in the Chromium GPU component.
The vulnerability allows the attacker to corrupt memory allocated for GPU processing.
The attacker manipulates memory to gain control of program execution.
The attacker injects malicious code into the browser process.
The injected code executes with the privileges of the browser process, allowing the attacker to perform actions such as stealing cookies, credentials, or installing malware.
The attacker gains persistent access to the compromised system and exfiltrates sensitive data.

Impact

A successful exploitation of CVE-2026-7333 could allow an attacker to execute arbitrary code on a user’s system. This could lead to the theft of sensitive information, installation of malware, or complete system compromise. Given the widespread use of Chromium-based browsers such as Chrome and Edge, this vulnerability has the potential to affect millions of users. The impact is considered critical due to the ease of exploitation and the potential for widespread damage.

Recommendation

Apply the latest security updates for Google Chrome and Microsoft Edge to patch CVE-2026-7333.
Deploy the Sigma rule “Detect Suspicious GPU Process Creation” to identify potential exploitation attempts.
Enable process creation logging with command-line arguments to detect suspicious processes spawned by the browser (logsource: process_creation).

Chromium Use-After-Free Vulnerability in Codecs (CVE-2026-7348)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:27 +0000

CVE-2026-7348 is a critical use-after-free vulnerability residing within the Codecs component of the Chromium browser engine. This vulnerability affects applications that utilize the Chromium engine, most notably Google Chrome and Microsoft Edge. While the specific details of the vulnerability are documented in Google Chrome Releases, the underlying issue stems from improper memory management within the Codecs library. Successful exploitation could allow an attacker to execute arbitrary code within the context of the affected browser, potentially leading to data theft, system compromise, or other malicious activities. This vulnerability requires immediate attention from organizations utilizing Chrome or Edge.

Attack Chain

An attacker crafts a malicious web page containing specially crafted media content designed to trigger the use-after-free condition in the Codecs library.
The user visits the malicious web page using Google Chrome or Microsoft Edge.
The browser attempts to process the malicious media content, triggering the vulnerable code path within the Codecs library.
The use-after-free condition is triggered when the browser attempts to access memory that has already been freed.
The attacker leverages the use-after-free condition to corrupt memory and gain control of program execution.
The attacker injects and executes arbitrary code within the context of the browser process.
The attacker gains unauthorized access to sensitive data, such as cookies, credentials, or browsing history.
The attacker potentially escalates privileges or installs malware on the user’s system.

Impact

Successful exploitation of CVE-2026-7348 allows an attacker to execute arbitrary code within the context of the affected browser (Chrome or Edge). This can lead to sensitive information disclosure, such as credentials or browsing history. The attacker could potentially gain full control of the user’s system. Given the widespread use of Chromium-based browsers, a successful exploit could impact a significant number of users across various sectors.

Recommendation

Upgrade Google Chrome to the latest version that addresses this vulnerability; refer to Google Chrome Releases.
Ensure Microsoft Edge is updated to the latest version incorporating the Chromium security patch.
Deploy the Sigma rule “Detect Chromium Codecs Use-After-Free Exploit Attempt” to identify potential exploitation attempts via webserver logs.
Enable webserver logging to capture HTTP requests, which is required for the provided Sigma rule.

Chromium Use-After-Free Vulnerability in Cast (CVE-2026-7349)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:27 +0000

CVE-2026-7349 is a use-after-free vulnerability found in the Cast component of the Chromium browser engine. This vulnerability affects Google Chrome and, by extension, Microsoft Edge, as Edge is built upon Chromium. Use-after-free vulnerabilities can allow an attacker to execute arbitrary code or cause a denial-of-service. While the original report comes from Chrome, the nature of Chromium’s shared codebase means that other Chromium-based browsers are also vulnerable. Successful exploitation of this vulnerability could lead to code execution within the context of the browser process. Defenders need to prioritize patching and monitoring for unusual browser behavior.

Attack Chain

An attacker crafts a malicious webpage designed to trigger the use-after-free vulnerability in the Cast component.
The user visits the malicious webpage using a vulnerable version of Chrome or Edge.
The Cast component attempts to access a freed memory location.
The attacker exploits the use-after-free condition to corrupt memory.
The attacker overwrites a function pointer or other critical data structure in memory.
The attacker triggers the execution of the corrupted function pointer or data structure.
The attacker gains arbitrary code execution within the context of the browser process.
The attacker could potentially escalate privileges or perform other malicious activities, such as installing malware or stealing sensitive data.

Impact

Successful exploitation of CVE-2026-7349 could allow an attacker to execute arbitrary code within the context of the browser, potentially leading to data theft, malware installation, or further system compromise. Given the widespread use of Chrome and Edge, this vulnerability has a significant impact. The specific number of potential victims is dependent on the speed of patching, but could potentially affect millions of users.

Recommendation

Apply the latest security updates for Google Chrome and Microsoft Edge to patch CVE-2026-7349.
Deploy the Sigma rules provided in this brief to your SIEM to detect potential exploitation attempts.
Monitor browser process execution for unexpected code loading or memory access patterns using process creation logs.
Implement memory protection techniques such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) to mitigate the impact of successful exploitation.

Chromium Use-After-Free Vulnerability in Cast (CVE-2026-7338)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:27 +0000

CVE-2026-7338 is a critical use-after-free vulnerability residing within the Cast component of the Chromium browser engine. Google Chrome and Microsoft Edge (Chromium-based) are both affected by this flaw. While the provided source does not specify the exact vulnerable versions, it indicates that Microsoft Edge ingests Chromium, and thus is affected by vulnerabilities addressed in Chromium releases. Successful exploitation of this vulnerability could lead to arbitrary code execution in the context of the user running the browser. This poses a significant risk, as attackers could potentially gain control of the user’s system. Defenders should prioritize patching affected browsers.

Attack Chain

An attacker crafts a malicious webpage or injects malicious code into a legitimate website that utilizes the Cast functionality.
The victim visits the malicious website or interacts with the compromised legitimate website using an affected browser (Chrome or Edge).
The malicious webpage triggers the use-after-free vulnerability in the Cast component.
The vulnerability allows the attacker to access memory that has already been freed.
The attacker overwrites the freed memory with attacker-controlled data.
The attacker manipulates the memory layout to redirect program execution.
The browser attempts to execute code from the attacker-controlled memory location.
This results in arbitrary code execution within the context of the browser process.

Impact

Successful exploitation of CVE-2026-7338 allows an attacker to execute arbitrary code on a victim’s machine. This can lead to complete system compromise, data theft, installation of malware, or other malicious activities. Given the widespread use of Chromium-based browsers like Chrome and Edge, this vulnerability has the potential to impact a large number of users across various sectors. The severity is critical due to the potential for remote code execution.

Recommendation

Apply the latest security updates for Google Chrome to address CVE-2026-7338 as detailed in Google Chrome Releases.
Apply the latest security updates for Microsoft Edge (Chromium-based) to address CVE-2026-7338, ensuring the ingested Chromium version contains the fix.
Deploy the Sigma rules provided in this brief to your SIEM to detect potential exploitation attempts targeting the Cast component.
Enable enhanced browser security features, such as sandboxing and site isolation, to limit the impact of potential exploits.

Chromium Heap Buffer Overflow Vulnerability (CVE-2026-7353)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:27 +0000

CVE-2026-7353 is a critical heap buffer overflow vulnerability residing within the Skia graphics library, a core component of the Chromium open-source project. This vulnerability impacts applications that utilize Chromium, including Google Chrome and Microsoft Edge. While the specific details of exploitation are not provided in this brief, the nature of a heap buffer overflow suggests a high potential for arbitrary code execution. Successful exploitation could allow an attacker to gain control of the affected browser process. Given the widespread use of Chromium-based browsers, this vulnerability poses a significant risk to a large user base. Defenders should prioritize patching and consider implementing mitigations to detect and prevent potential exploitation attempts.

Attack Chain

An attacker crafts a malicious web page or injects malicious content into a trusted website.
The victim visits the malicious web page or interacts with the injected content using a Chromium-based browser (Chrome or Edge).
The browser’s rendering engine, utilizing the Skia library, processes the malicious content, triggering the heap buffer overflow in Skia.
The overflow allows the attacker to overwrite adjacent memory regions in the heap.
By carefully crafting the overflowed data, the attacker can overwrite critical data structures within the browser process.
The attacker gains control of the execution flow by overwriting function pointers or other control data.
The attacker executes arbitrary code within the context of the browser process.
The attacker could then perform actions such as installing malware, stealing sensitive data, or further compromising the system.

Impact

Successful exploitation of CVE-2026-7353 allows for arbitrary code execution within the context of the affected browser process. This can lead to a complete compromise of the user’s browser session, potentially enabling the attacker to steal credentials, inject malicious code into other websites, or install malware on the victim’s system. Given the widespread use of Chrome and Edge, the potential impact is significant, affecting potentially millions of users.

Recommendation

Apply the latest security updates for Google Chrome and Microsoft Edge to patch CVE-2026-7353.
Deploy the following Sigma rule to detect potential exploitation attempts based on suspicious process execution originating from the browser (see “Detect Suspicious Process Creation from Browser”).
Enable enhanced browser security features such as site isolation to mitigate the impact of successful exploitation.

Browser Process Spawned from an Unusual Parent

hello@craftedsignal.io — Wed, 03 Jan 2024 18:15:00 +0000

This detection identifies instances where a browser process, specifically Google Chrome or Microsoft Edge, is initiated from an unexpected parent process on a Windows system. The rule focuses on scenarios where browsers are launched with arguments indicative of remote debugging, headless automation, or minimal user interaction. Such activity can signal an attempt to manipulate a browser session for malicious purposes, potentially leading to credential theft or unauthorized access to sensitive information. The rule is designed to leverage data from Elastic Defend, Microsoft Defender XDR, SentinelOne Cloud Funnel, Sysmon, and Windows Process Creation Logs.

Attack Chain

An attacker gains initial access to a Windows system (e.g., via phishing or exploiting a vulnerability).
The attacker executes a script or command to launch a browser process (chrome.exe or msedge.exe).
The browser is launched with specific command-line arguments, such as --remote-debugging-port, --headless, or --window-position=-x,-y, to enable remote control or hide the browser window.
The parent process of the browser is an unusual executable, not typically associated with launching browsers (e.g., not explorer.exe).
The attacker leverages the remote debugging port to interact with the browser session programmatically.
The attacker attempts to steal credentials or session cookies from the browser.
The attacker uses stolen credentials to access sensitive data.

Impact

Successful exploitation can lead to the theft of user credentials, enabling unauthorized access to sensitive data and systems. This could result in financial loss, data breaches, and reputational damage for affected organizations. The targeted use of browser manipulation techniques increases the likelihood of bypassing traditional security controls.

Recommendation

Deploy the Sigma rule Browser Process Spawned from Unusual Parent to your SIEM and tune for your environment.
Enable Sysmon process-creation logging (Event ID 1) to collect the necessary data for the Sigma rule.
Investigate any alerts generated by the Browser Process Spawned from Unusual Parent Sigma rule.
Review process command lines for arguments like --remote-debugging-port or --headless to identify potential browser manipulation attempts.
Monitor network connections originating from browser processes for unexpected destinations, as described in the investigation guide from the source.

Startup or Run Key Registry Modification

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

Attackers often modify registry run keys to achieve persistence on a system. By adding entries to these keys, they ensure that a malicious program executes automatically whenever a user logs in. This technique allows the attacker to maintain access to the compromised system even after reboots or other interruptions. The programs added to these run keys execute under the context of the user account, inheriting its permissions. This activity is often difficult to distinguish from legitimate software installations or updates, requiring careful analysis to identify malicious intent. Elastic has observed this activity and created a detection rule to identify this behavior.

Attack Chain

The attacker gains initial access to the target system.
The attacker identifies registry run key locations for persistence.
The attacker modifies a registry run key (e.g., HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) using tools such as reg.exe.
The attacker adds a malicious executable path to the registry key.
The system is restarted, or a user logs in.
The malicious executable is launched automatically as part of the logon process.
The malicious executable establishes a connection to a command-and-control server.
The attacker gains remote access to the compromised system.

Impact

Successful exploitation allows attackers to maintain persistent access to compromised systems, enabling them to perform unauthorized activities such as data theft, lateral movement, and deployment of ransomware. While each instance may not cause immediate critical damage, the cumulative effect of multiple persistent infections across an environment can lead to significant data breaches and operational disruption. The Elastic rule attempts to minimize false positives with built-in filters for common legitimate applications and processes like ctfmon.exe, but tuning is required.

Recommendation

Deploy the Sigma rule provided below to detect suspicious modifications to registry run keys and tune it to filter out legitimate application updates.
Enable registry event logging to capture modifications made to the registry, ensuring that the Sigma rule can function correctly.
Investigate any alerts generated by the Sigma rule, examining the parent process of the process modifying the registry for suspicious activity.
Block known malicious executables and domains identified during triage to prevent further infection.
Use endpoint detection and response (EDR) solutions like Elastic Defend to gain enhanced visibility into endpoint activity and detect malicious behavior associated with persistence mechanisms.

RMM Domain DNS Queries from Non-Browser Processes

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This detection identifies potentially malicious use of Remote Monitoring and Management (RMM) tools by detecting DNS queries to known RMM domains originating from processes that are not web browsers. Attackers frequently abuse legitimate RMM software for command and control, persistence, and lateral movement within compromised networks. This rule focuses on surfacing RMM clients, scripts, or other non-browser activity contacting these services, thereby increasing the likelihood of detecting unauthorized remote access or malicious activity. The rule aims to reduce false positives by excluding common browser processes and focusing on unusual network activity. The identified domains are associated with various RMM tools like TeamViewer, AnyDesk, and ScreenConnect. This detection is relevant for organizations concerned about insider threats, supply chain attacks, or general compromise leading to unauthorized remote access.

Attack Chain

An attacker gains initial access to a system, possibly through phishing or exploiting a vulnerability.
The attacker installs an unauthorized RMM tool (e.g., using a script or installer).
The RMM tool initiates a DNS query to resolve its command and control domain (e.g., teamviewer.com).
The system, now running the RMM agent, establishes a connection to the attacker-controlled RMM server.
The attacker uses the RMM tool to execute commands on the compromised system.
The attacker uses the RMM tool for lateral movement within the network.
The attacker uses the RMM tool to maintain persistence on the compromised system.

Impact

Compromise via unauthorized RMM tools can provide attackers with persistent remote access, enabling them to perform a range of malicious activities, including data theft, ransomware deployment, and further lateral movement within the network. Successful exploitation can lead to significant financial loss, reputational damage, and disruption of business operations. The number of affected systems can vary depending on the scope of the initial compromise and the attacker’s ability to move laterally.

Recommendation

Deploy the Sigma rule RMM Domain DNS Queries from Non-Browser Processes to your SIEM and tune it to your environment, excluding legitimate non-browser processes that use RMM tools.
Investigate any alerts generated by the rule, focusing on identifying the process making the DNS query and its parent process, as outlined in the rule’s description.
Monitor DNS query logs for queries to the RMM domains listed in the IOC table, and block them at the DNS resolver if unauthorized RMM use is confirmed.
Enable Sysmon Event ID 22 (DNS Query) logging to provide the necessary data for this detection, as recommended in the “Setup” section of the content.

DNS-over-HTTPS Enabled via Registry Modification

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

The use of DNS-over-HTTPS (DoH) can obscure network activity, potentially allowing malicious actors to bypass traditional DNS monitoring and conceal data exfiltration. When DoH is enabled, visibility into DNS query types, responses, and originating IPs is lost, hindering the detection of malicious activity. This behavior is detected by monitoring registry modifications associated with enabling DoH in popular browsers such as Microsoft Edge, Google Chrome, and Mozilla Firefox. The registry keys targeted are associated with settings that force the browsers to use secure DNS resolution, potentially circumventing organizational security policies.

Attack Chain

Initial Access: An attacker gains initial access to a Windows system through various means, such as phishing or exploiting a software vulnerability.
Privilege Escalation (if necessary): The attacker may need to escalate privileges to modify registry settings.
Defense Evasion: The attacker modifies the Windows registry to enable DNS-over-HTTPS (DoH) in web browsers like Edge, Chrome, or Firefox. This is achieved by modifying specific registry keys such as HKLM\SOFTWARE\Policies\Microsoft\Edge\BuiltInDnsClientEnabled, HKLM\SOFTWARE\Google\Chrome\DnsOverHttpsMode, or HKLM\SOFTWARE\Policies\Mozilla\Firefox\DNSOverHTTPS.
Obfuscation: By enabling DoH, the attacker encrypts DNS queries, making it difficult for network monitoring tools to inspect DNS traffic.
Command and Control: The attacker establishes command and control (C2) communication with a remote server over encrypted DNS traffic, evading traditional network-based detection methods.
Data Exfiltration: The attacker uses the encrypted DNS channel to exfiltrate sensitive data, bypassing network security controls that rely on DNS inspection.
Persistence (Optional): The attacker might establish persistence by ensuring the DoH settings remain enabled across system reboots.

Impact

Successful exploitation leads to a loss of visibility into DNS traffic, hindering incident response and threat hunting efforts. Attackers can effectively hide command-and-control communications and data exfiltration activities. Although this activity by itself isn’t inherently malicious, it removes a layer of defense, increasing the risk that malicious activities will go undetected.

Recommendation

Deploy the Sigma rules provided in this brief to your SIEM to detect the enabling of DNS-over-HTTPS via registry modifications.
Enable Sysmon registry event logging to capture the necessary events for the provided Sigma rules to function effectively.
Review and update security policies to ensure DNS-over-HTTPS is only enabled through approved channels and for legitimate purposes, reducing the risk of misuse, and create exceptions in the detection rule for systems where this is a known requirement.
Investigate any alerts generated by the Sigma rules, focusing on identifying the user account, process, and associated network activity (reference the investigation guide in the source URL).

Masquerading Business Application Installers

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

Attackers often attempt to trick users into downloading and executing malicious executables by disguising them as legitimate business applications. This tactic is used to bypass security measures and gain initial access to a system. These malicious executables, often distributed via malicious ads, forum posts, and tutorials, mimic the names of commonly used applications such as Slack, WebEx, Teams, Discord, and Zoom. The executables are typically unsigned or signed with invalid certificates to further evade detection. This allows the attacker to execute arbitrary code on the victim’s machine, potentially leading to further compromise. This campaign aims to target end-users who are less security-aware, and this makes social engineering attacks like this very effective.

Attack Chain

The user visits a compromised website or clicks on a malicious advertisement.
The user is prompted to download an installer file masquerading as a legitimate business application (e.g., Slack, Zoom, Teams) from a download directory.
The downloaded executable is placed in the user’s Downloads folder (e.g., C:\Users*\Downloads*).
The user executes the downloaded file.
The executable, lacking a valid code signature, begins execution.
The malicious installer may drop and execute additional malware components.
The malware establishes persistence, potentially using techniques such as registry key modification.
The malware performs malicious activities, such as data exfiltration or lateral movement.

Impact

Successful execution of a masqueraded business application installer can lead to a complete system compromise. The attacker gains initial access and can deploy various malware payloads, including ransomware, keyloggers, and data stealers. This can result in data breaches, financial loss, and reputational damage. Although the specific number of victims and sectors targeted are not detailed, the widespread use of the applications being spoofed (Slack, Zoom, etc.) suggests a broad potential impact.

Recommendation

Implement the Sigma rule Potential Masquerading as Business App Installer to detect unsigned executables resembling legitimate business applications in download directories.
Enable process creation logging to capture the execution of unsigned executables.
Educate users on the risks of downloading and executing files from untrusted sources.
Implement application whitelisting to restrict the execution of unauthorized applications.
Regularly update endpoint detection and response (EDR) tools to detect and prevent the execution of known malware.
Monitor process execution events for processes originating from the Downloads folder that lack valid code signatures.