Running Chrome VPN Extensions via the Registry 2 VPN Extension

Title: Running Chrome VPN Extensions via the Registry 2 VPN Extension
Status: test
Description:Running Chrome VPN Extensions via the Registry install 2 vpn extension
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1133/T1133.md#atomic-test-1---running-chrome-vpn-extensions-via-the-registry-2-vpn-extension
Author: frack113
Date: 2021-12-28
modified:2023-08-17
Tags:

• -'attack.initial-access'
• -'attack.persistence'
• -'attack.t1133'

Logsource:

• category: registry_set
• product: windows

Detection:
  chrome_ext:
    TargetObject|contains: 'Software\Wow6432Node\Google\Chrome\Extensions'
    TargetObject|endswith: 'update_url'
  chrome_vpn:
    TargetObject|contains:
      -'fdcgdnkidjaadafnichfpabhfomcebme'
      -'fcfhplploccackoneaefokcmbjfbkenj'
      -'bihmplhobchoageeokmgbdihknkjbknd'
      -'gkojfkhlekighikafcpjkiklfbnlmeio'
      -'jajilbjjinjmgcibalaakngmkilboobh'
      -'gjknjjomckknofjidppipffbpoekiipm'
      -'nabbmpekekjknlbkgpodfndbodhijjem'
      -'kpiecbcckbofpmkkkdibbllpinceiihk'
      -'nlbejmccbhkncgokjcmghpfloaajcffj'
      -'omghfjlpggmjjaagoclmmobgdodcjboh'
      -'bibjcjfmgapbfoljiojpipaooddpkpai'
      -'mpcaainmfjjigeicjnlkdfajbioopjko'
      -'jljopmgdobloagejpohpldgkiellmfnc'
      -'lochiccbgeohimldjooaakjllnafhaid'
      -'nhnfcgpcbfclhfafjlooihdfghaeinfc'
      -'ookhnhpkphagefgdiemllfajmkdkcaim'
      -'namfblliamklmeodpcelkokjbffgmeoo'
      -'nbcojefnccbanplpoffopkoepjmhgdgh'
      -'majdfhpaihoncoakbjgbdhglocklcgno'
      -'lnfdmdhmfbimhhpaeocncdlhiodoblbd'
      -'eppiocemhmnlbhjplcgkofciiegomcon'
      -'cocfojppfigjeefejbpfmedgjbpchcng'
      -'foiopecknacmiihiocgdjgbjokkpkohc'
      -'hhdobjgopfphlmjbmnpglhfcgppchgje'
      -'jgbaghohigdbgbolncodkdlpenhcmcge'
      -'inligpkjkhbpifecbdjhmdpcfhnlelja'
      -'higioemojdadgdbhbbbkfbebbdlfjbip'
      -'hipncndjamdcmphkgngojegjblibadbe'
      -'iolonopooapdagdemdoaihahlfkncfgg'
      -'nhfjkakglbnnpkpldhjmpmmfefifedcj'
      -'jpgljfpmoofbmlieejglhonfofmahini'
      -'fgddmllnllkalaagkghckoinaemmogpe'
      -'ejkaocphofnobjdedneohbbiilggdlbi'
      -'keodbianoliadkoelloecbhllnpiocoi'
      -'hoapmlpnmpaehilehggglehfdlnoegck'
      -'poeojclicodamonabcabmapamjkkmnnk'
      -'dfkdflfgjdajbhocmfjolpjbebdkcjog'
      -'kcdahmgmaagjhocpipbodaokikjkampi'
      -'klnkiajpmpkkkgpgbogmcgfjhdoljacg'
      -'lneaocagcijjdpkcabeanfpdbmapcjjg'
      -'pgfpignfckbloagkfnamnolkeaecfgfh'
      -'jplnlifepflhkbkgonidnobkakhmpnmh'
      -'jliodmnojccaloajphkingdnpljdhdok'
      -'hnmpcagpplmpfojmgmnngilcnanddlhb'
      -'ffbkglfijbcbgblgflchnbphjdllaogb'
      -'kcndmbbelllkmioekdagahekgimemejo'
      -'jdgilggpfmjpbodmhndmhojklgfdlhob'
      -'bihhflimonbpcfagfadcnbbdngpopnjb'
      -'ppajinakbfocjfnijggfndbdmjggcmde'
      -'oofgbpoabipfcfjapgnbbjjaenockbdp'
      -'bhnhkdgoefpmekcgnccpnhjfdgicfebm'
      -'knmmpciebaoojcpjjoeonlcjacjopcpf'
      -'dhadilbmmjiooceioladdphemaliiobo'
      -'jedieiamjmoflcknjdjhpieklepfglin'
      -'mhngpdlhojliikfknhfaglpnddniijfh'
      -'omdakjcmkglenbhjadbccaookpfjihpa'
      -'npgimkapccfidfkfoklhpkgmhgfejhbj'
      -'akeehkgglkmpapdnanoochpfmeghfdln'
      -'gbmdmipapolaohpinhblmcnpmmlgfgje'
      -'aigmfoeogfnljhnofglledbhhfegannp'
      -'cgojmfochfikphincbhokimmmjenhhgk'
      -'ficajfeojakddincjafebjmfiefcmanc'
      -'ifnaibldjfdmaipaddffmgcmekjhiloa'
      -'jbnmpdkcfkochpanomnkhnafobppmccn'
      -'apcfdffemoinopelidncddjbhkiblecc'
      -'mjolnodfokkkaichkcjipfgblbfgojpa'
      -'oifjbnnafapeiknapihcmpeodaeblbkn'
      -'plpmggfglncceinmilojdkiijhmajkjh'
      -'mjnbclmflcpookeapghfhapeffmpodij'
      -'bblcccknbdbplgmdjnnikffefhdlobhp'
      -'aojlhgbkmkahabcmcpifbolnoichfeep'
      -'lcmammnjlbmlbcaniggmlejfjpjagiia'
      -'knajdeaocbpmfghhmijicidfcmdgbdpm'
      -'bdlcnpceagnkjnjlbbbcepohejbheilk'
      -'edknjdjielmpdlnllkdmaghlbpnmjmgb'
      -'eidnihaadmmancegllknfbliaijfmkgo'
      -'ckiahbcmlmkpfiijecbpflfahoimklke'
      -'macdlemfnignjhclfcfichcdhiomgjjb'
      -'chioafkonnhbpajpengbalkececleldf'
      -'amnoibeflfphhplmckdbiajkjaoomgnj'
      -'llbhddikeonkpbhpncnhialfbpnilcnc'
      -'pcienlhnoficegnepejpfiklggkioccm'
      -'iocnglnmfkgfedpcemdflhkchokkfeii'
      -'igahhbkcppaollcjeaaoapkijbnphfhb'
      -'njpmifchgidinihmijhcfpbdmglecdlb'
      -'ggackgngljinccllcmbgnpgpllcjepgc'
      -'kchocjcihdgkoplngjemhpplmmloanja'
      -'bnijmipndnicefcdbhgcjoognndbgkep'
      -'lklekjodgannjcccdlbicoamibgbdnmi'
      -'dbdbnchagbkhknegmhgikkleoogjcfge'
      -'egblhcjfjmbjajhjhpmnlekffgaemgfh'
      -'ehbhfpfdkmhcpaehaooegfdflljcnfec'
      -'bkkgdjpomdnfemhhkalfkogckjdkcjkg'
      -'almalgbpmcfpdaopimbdchdliminoign'
      -'akkbkhnikoeojlhiiomohpdnkhbkhieh'
      -'gbfgfbopcfokdpkdigfmoeaajfmpkbnh'
      -'bniikohfmajhdcffljgfeiklcbgffppl'
      -'lejgfmmlngaigdmmikblappdafcmkndb'
      -'ffhhkmlgedgcliajaedapkdfigdobcif'
      -'gcknhkkoolaabfmlnjonogaaifnjlfnp'
      -'pooljnboifbodgifngpppfklhifechoe'
      -'fjoaledfpmneenckfbpdfhkmimnjocfa'
      -'aakchaleigkohafkfjfjbblobjifikek'
      -'dpplabbmogkhghncfbfdeeokoefdjegm'
      -'padekgcemlokbadohgkifijomclgjgif'
      -'bfidboloedlamgdmenmlbipfnccokknp'

  condition:all of chrome_*
Falsepositives:
  -Unknown
Level: high