Active Threat Brief: Chrome Zero-Day and UniFi VPN Flaws — Detection and Hardening

---
title: Potential Chrome Zero-Day Exploit Chain
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects suspicious child process spawns from Chrome browser, indicative of potential sandbox escape or exploit activity.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/06/02
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate user downloads or browser-based utilities (rare)
level: high
---
title: UniFi VPN Deprecated Protocol Usage
id: b2c3d4e5-6789-01ab-cdef-234567890bcd
status: experimental
description: Detects connection attempts to UniFi management interfaces or VPN endpoints using deprecated or insecure protocols.
references:
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/06/02
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: network_connection
  product: windows
detection:
  selection_ports:
    DestinationPort:
      - 8080  # UniFi Controller HTTP (unencrypted)
      - 8880  # UniFi Controller HTTP Redirect
      - 8443  # UniFi Controller HTTPS
      - 1194  # OpenVPN (if deprecated config used)
  selection_keywords:
    Initiated: 'true'
  condition: all of selection_*
falsepositives:
  - Legitimate administrative access to UniFi Controller
level: medium
---
title: macOS Stealer Persistence via LaunchAgent
id: c3d4e5f6-7890-12ab-cdef-345678901cde
status: experimental
description: Detects creation of suspicious LaunchAgents or LaunchDaemons often used by macOS stealers for persistence.
references:
  - https://attack.mitre.org/techniques/T1543/
author: Security Arsenal
date: 2026/06/02
tags:
  - attack.persistence
  - attack.t1543
logsource:
  category: file_event
  product: macos
detection:
  selection_paths:
    TargetFilePath|contains:
      - '/Library/LaunchAgents/'
      - '/Library/LaunchDaemons/'
      - '~/Library/LaunchAgents/'
  selection_extensions:
    TargetFilePath|endswith: '.plist'
  condition: all of selection_*
falsepositives:
  - Legitimate software installation
level: low

// Hunt for Chrome Exploit Spawns
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName == "chrome.exe"
| where FileName in ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe")
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc

// Hunt for UniFi/VPN Management Access
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort in (8080, 8880, 8443, 1194)
| where ActionType == "ConnectionSuccess" 
| summarize count() by DeviceName, RemotePort, RemoteUrl
| order by count_ desc

-- Hunt for macOS Stealer Persistence in User LaunchAgents
SELECT FullPath, Mtime, Atime, Btime, Size, Mode
FROM glob(globs='/*/Library/LaunchAgents/*.plist')
WHERE Mtime > now() - timedelta(days=7)

-- Hunt for Suspicious Network Connections on macOS
SELECT Fd, Family, Type, RemoteAddr, RemotePort, State, PID
FROM netstat()
WHERE RemotePort IN (8080, 8443, 443)
  AND State == 'ESTABLISHED'

# Check for active listeners on UniFi Management Ports (Requires Admin)
Write-Host "Checking for listeners on UniFi management ports..."
$ports = @(8080, 8880, 8443)
$listeners = Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | Where-Object { $ports -contains $_.LocalPort }

if ($listeners) {
    Write-Host "[WARNING] Listeners found on UniFi default ports. Review processes:" -ForegroundColor Yellow
    $listeners | ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        Write-Host "Port: $($_.LocalPort) | PID: $($_.OwningProcess) | Process: $($proc.ProcessName) | Path: $($proc.Path)"
    }
} else {
    Write-Host "[INFO] No listeners detected on standard UniFi management ports." -ForegroundColor Green
}

# Verify Chrome Version (Generic Check)
Write-Host "\nChecking Google Chrome Version..."
$chromePath = "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe"
if (Test-Path $chromePath) {
    $versionInfo = (Get-Item $chromePath).VersionInfo.FileVersion
    Write-Host "Current Chrome Version: $versionInfo"
    Write-Host "Action: Compare against latest secure channel release. If out of date, enforce update via Group Policy immediately."
} else {
    Write-Host "Chrome not found in default path."
}