Belgium eID Browser Extension RCE: How a Compromised Trust Framework Exposed Citizen Accounts — Detection and Hardening Guide

---
title: Browser Process Spawning Shell or Script Interpreter - Potential Extension or Native Messaging RCE
id: 3f8a2c71-9d4e-4b6a-ae15-7c2d5f9b1e08
status: experimental
description: Detects web browsers spawning command shells or script interpreters, consistent with code execution achieved through a malicious or compromised browser extension or native messaging host such as the Belgium eID extension flaw. Browsers should not ordinarily parent cmd, powershell, wscript, or rundll32.
references:
  - https://www.darkreading.com/application-security/belgium-eid-authentication-citizen-accounts-rce
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1554/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.persistence
  - attack.t1554
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  filter_known_native_hosts:
    CommandLine|contains:
      - 'native messaging host'
  condition: selection_parent and selection_child and not filter_known_native_hosts
falsepositives:
  - Legitimate native messaging hosts (eID middleware, SSO brokers, enterprise password managers) spawning helper processes; baseline these by full command line, not process name
  - Browser crash-reporting utilities
level: high
---
title: Unsigned or User-Directory Binary Executed as Browser Native Messaging Host
id: 8b1e4d92-6c3f-4a78-bd29-1e5f7a3c9d46
status: experimental
description: Detects execution of native messaging host binaries from user-writable or non-standard locations. Legitimate middleware (including Belgium eID) installs its native messaging host under Program Files; execution from AppData, Temp, or Public directories indicates a trojanized or rogue host registered by a malicious extension.
references:
  - https://www.darkreading.com/application-security/belgium-eid-authentication-citizen-accounts-rce
  - https://attack.mitre.org/techniques/T1554/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1554
  - attack.defense_evasion
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\ProgramData\Microsoft\Crypto\'
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  condition: selection_path and selection_parent
falsepositives:
  - Some legitimate password-manager and SSO extensions install hosts under AppData; verify publisher signature before allowlisting
level: high

let BrowserProcesses = dynamic(['chrome.exe','msedge.exe','firefox.exe','brave.exe']);
let SuspiciousChildren = dynamic(['cmd.exe','powershell.exe','pwsh.exe','wscript.exe','cscript.exe','mshta.exe','rundll32.exe','regsvr32.exe']);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ (BrowserProcesses)
| where FileName in~ (SuspiciousChildren)
   or (FolderPath has_any ('\\AppData\\Local\\Temp\\','\\Users\\Public\\') and InitiatingProcessFileName in~ (BrowserProcesses))
| summarize ExecutionCount = count(),
            DistinctDevices = dcount(DeviceId),
            Devices = make_set(DeviceName, 10),
            SampleCommandLine = take_any(ProcessCommandLine)
    by FileName, FolderPath, InitiatingProcessFileName
| extend PrevalenceTier = case(DistinctDevices <= 5, 'LOW - Investigate Immediately',
                               DistinctDevices <= 50, 'MEDIUM - Verify Against Software Inventory',
                               'HIGH - Likely Sanctioned Middleware')
| order by DistinctDevices asc;

-- Enumerate native messaging host registrations and validate their install paths
LET registry_hives = ('HKEY_LOCAL_MACHINE/SOFTWARE/Google/Chrome/NativeMessagingHosts/*',
                      'HKEY_CURRENT_USER/SOFTWARE/Google/Chrome/NativeMessagingHosts/*',
                      'HKEY_LOCAL_MACHINE/SOFTWARE/Mozilla/NativeMessagingHosts/*',
                      'HKEY_CURRENT_USER/SOFTWARE/Mozilla/NativeMessagingHosts/*',
                      'HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Edge/NativeMessagingHosts/*')

SELECT Key.OSPath AS RegistryPath,
       Key.Name AS HostName,
       read_file(filename=Key.OSPath.OSPath) AS ManifestPointer
FROM foreach(row=registry_hives,
             query={SELECT * FROM glob(globs=OSPath, accessor='registry')})
WHERE HostName IS NOT NULL

-- Correlate with running browser-spawned child processes
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE get(field='Ppid') IN (SELECT Pid FROM pslist()
                            WHERE Name =~ '(chrome|msedge|firefox|brave)\\.exe')
  AND (Name =~ '(cmd|powershell|wscript|cscript|mshta|rundll32)\\.exe'
       OR Exe =~ '(AppData\\\\Local\\\\Temp|Users\\\\Public)')

# Belgium eID / Native Messaging Host Audit Script
# Run as Administrator on Windows endpoints. Outputs JSON for SIEM ingestion.

$findings = @()

# 1. Enumerate native messaging host registrations (Chrome, Edge, Firefox)
$nmhRoots = @(
    'HKLM:\SOFTWARE\Google\Chrome\NativeMessagingHosts',
    'HKCU:\SOFTWARE\Google\Chrome\NativeMessagingHosts',
    'HKLM:\SOFTWARE\Microsoft\Edge\NativeMessagingHosts',
    'HKCU:\SOFTWARE\Microsoft\Edge\NativeMessagingHosts',
    'HKLM:\SOFTWARE\Mozilla\NativeMessagingHosts',
    'HKCU:\SOFTWARE\Mozilla\NativeMessagingHosts'
)

foreach ($root in $nmhRoots) {
    if (Test-Path $root) {
        Get-ChildItem $root | ForEach-Object {
            $manifestPath = (Get-ItemProperty $_.PSPath).'(default)'
            if (-not $manifestPath) {
                $manifestPath = (Get-ItemProperty $_.PSPath).'(Default)'
            }
            $suspicious = $false
            $reason = ''
            if ($manifestPath -match 'AppData\\Local\\Temp|Users\\Public|\\Downloads\\') {
                $suspicious = $true; $reason = 'Host manifest in user-writable/unexpected path'
            }
            # Parse manifest and validate the host binary signature
            if ($manifestPath -and (Test-Path $manifestPath)) {
                try {
                    $manifest = Get-Content $manifestPath -Raw | ConvertFrom-Json
                    $hostExe = $manifest.path
                    if ($hostExe -and (Test-Path $hostExe)) {
                        $sig = Get-AuthenticodeSignature $hostExe
                        if ($sig.Status -ne 'Valid') {
                            $suspicious = $true; $reason = "Host binary unsigned or invalid signature: $hostExe"
                        }
                    }
                } catch { $reason = 'Manifest parse failure - inspect manually' }
            }
            $findings += [PSCustomObject]@{
                HostName     = $_.PSChildName
                RegistryRoot = $root
                ManifestPath = $manifestPath
                Suspicious   = $suspicious
                Reason       = $reason
                Timestamp    = (Get-Date).ToString('o')
            }
        }
    }
}

# 2. Inventory installed extensions across all Chrome/Edge user profiles
$extensionDirs = @(
    "$env:LOCALAPPDATA\Google\Chrome\User Data\*\Extensions",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\*\Extensions"
)
foreach ($dir in $extensionDirs) {
    Get-ChildItem $dir -ErrorAction SilentlyContinue | ForEach-Object {
        Get-ChildItem $_.FullName -ErrorAction SilentlyContinue | ForEach-Object {
            $manifestFile = Join-Path $_.FullName 'manifest.json'
            if (Test-Path $manifestFile) {
                $m = Get-Content $manifestFile -Raw | ConvertFrom-Json
                $perms = ($m.permissions + $m.host_permissions) -join ','
                $risky = $perms -match '<all_urls>|nativeMessaging|webRequest|cookies'
                $findings += [PSCustomObject]@{
                    HostName     = "EXT:$($m.name)"
                    RegistryRoot = $_.Parent.Parent.FullName
                    ManifestPath = $manifestFile
                    Suspicious   = ($risky -and $m.name -notmatch 'eID|beid')
                    Reason       = "High-privilege permissions: $perms"
                    Timestamp    = (Get-Date).ToString('o')
                }
            }
        }
    }
}

# 3. Output flagged results
$findings | Where-Object { $_.Suspicious } | ConvertTo-Json -Depth 4
Write-Host "`nTotal artifacts audited: $($findings.Count). Flagged: $(($findings | Where-Object Suspicious).Count)"