BlueMoon Chrome+Windows Exploit Kit Adopted by Four Nation-State Actors in 12 Days — Detection and Remediation Guide

---
title: Chrome Browser Spawning Scripting or LOLBin Child Processes
description: Detects chrome.exe spawning command interpreters or living-off-the-land binaries, consistent with post-exploitation following a Chrome renderer compromise such as the BlueMoon exploit kit chain.
references:
  - https://securityaffairs.com/198783/apt/four-nation-state-actors-used-the-same-chrome-zero-day-exploit-kit-within-12-days.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
status: experimental
date: 2026/02/18
tags:
  - attack.execution
  - attack.t1059
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\chrome.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\wmic.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare. Enterprise browser extensions or internal web apps invoking local handlers. Investigate every hit.
level: high
---
title: Executable Dropped by Chrome in User-Writable Directory Then Executed
description: Detects execution of binaries from user-writable staging directories where the parent process is chrome.exe, matching the payload-staging behavior of browser exploit kits including BlueMoon.
references:
  - https://securityaffairs.com/198783/apt/four-nation-state-actors-used-the-same-chrome-zero-day-exploit-kit-within-12-days.html
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
status: experimental
date: 2026/02/18
tags:
  - attack.execution
  - attack.t1203
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\chrome.exe'
  selection_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\ProgramData\'
      - '\Users\Public\'
      - '\Downloads\'
  filter_extension:
    Image|endswith:
      - '.exe'
      - '.dll'
      - '.scr'
      - '.com'
  condition: selection_parent and selection_path and filter_extension
falsepositives:
  - Chrome component updater and legitimate browser-driven installers. Baseline known-good updater paths and exclude.
level: high
---
title: Chrome Process Writing Suspicious Executable or Script to Disk
description: Detects chrome.exe writing executable or script content outside standard cache/download locations, indicative of exploit kit payload staging following renderer compromise.
references:
  - https://securityaffairs.com/198783/apt/four-nation-state-actors-used-the-same-chrome-zero-day-exploit-kit-within-12-days.html
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
status: experimental
date: 2026/02/18
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith: '\chrome.exe'
  selection_extension:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.ps1'
      - '.bat'
      - '.vbs'
      - '.js'
      - '.hta'
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\ProgramData\'
      - '\Users\Public\'
  filter_known:
    TargetFilename|contains:
      - '\Google\Chrome\'
  condition: selection_image and selection_extension and selection_path and not filter_known
falsepositives:
  - Browser extension installers and enterprise software distribution via browser. Tune to environment.
level: medium

// Hunt: Chrome exploit chain behavior — suspicious children + anomalous network egress
// Part 1: chrome.exe spawning scripting engines / LOLBins (BlueMoon post-exploitation)
let SuspiciousChildren = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "chrome.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe","wmic.exe")
| project DeviceName, AccountName, TimeGenerated, FileName, ProcessCommandLine, InitiatingProcessCommandLine, SHA256;
// Part 2: chrome.exe connecting to destinations rare across the tenant (exploit kit infra / payload fetch)
let RareEgress = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "chrome.exe"
| where RemoteIPType == "Public"
| summarize ConnectionCount = count(), Devices = dcount(DeviceId), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by RemoteUrl, RemoteIP, RemotePort
| where Devices <= 3 and ConnectionCount < 20  // rare across fleet = suspicious
| order by FirstSeen desc;
SuspiciousChildren
| union (RareEgress | project DeviceName="(network)", AccountName="-", TimeGenerated=LastSeen, FileName=strcat("NET:", RemoteUrl), ProcessCommandLine=strcat(RemoteIP, ":", RemotePort), InitiatingProcessCommandLine=strcat("Conns=", ConnectionCount, " Devices=", Devices), SHA256=strcat("FirstSeen: ", FirstSeen))
| order by TimeGenerated desc

-- Hunt: Chrome processes with suspicious children and their network connections
-- Deploy as a hunt across the fleet; enrich with hash lookups on results.
LET children = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil)\.exe'

LET parents = SELECT Pid AS ParentPid, Name AS ParentName, Exe AS ParentExe
FROM pslist()
WHERE Name =~ '(?i)chrome\.exe'

LET conns = SELECT Pid AS ConnPid, Family, Type, Status,
       Laddr.IP AS LocalIP, Laddr.Port AS LocalPort,
       Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort
FROM netstat()
WHERE Status =~ 'ESTABLISHED'

SELECT children.Pid, children.Name, children.CommandLine, children.Username,
       children.CreateTime, parents.ParentName, parents.ParentExe,
       conns.RemoteIP, conns.RemotePort
FROM children
JOIN parents ON children.Ppid = parents.ParentPid
LEFT JOIN conns ON children.Pid = conns.ConnPid

# BlueMoon Response: Chrome version verification + update enforcement + artifact sweep
# Run elevated. Exit 1 if remediation required; suitable for RMM/Intune proactive remediations.

$requiredMinVersion = [version]"0.0.0.0"  # Set to Google's current stable baseline, e.g. [version]"1xx.x.xxxx.xx"
$issues = @()

# --- 1. Check installed Chrome version ---
$chromePaths = @(
    "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
    "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe"
)
$installedVersion = $null
foreach ($p in $chromePaths) {
    if (Test-Path $p) {
        $installedVersion = (Get-Item $p).VersionInfo.ProductVersion
        break
    }
}
if (-not $installedVersion) {
    $issues += "Chrome not found in standard install paths - verify coverage"
} else {
    Write-Host "Chrome version detected: $installedVersion"
    # Compare against Google's current stable (fetch manually or via your patch feed)
    # if ([version]$installedVersion -lt $requiredMinVersion) { $issues += "Chrome below required baseline" }
}

# --- 2. Enforce Chrome auto-update policy (prevents user deferral of security fixes) ---
$policyPath = "HKLM:\SOFTWARE\Policies\Google\Update"
if (-not (Test-Path $policyPath)) { New-Item -Path $policyPath -Force | Out-Null }
Set-ItemProperty -Path $policyPath -Name "AutoUpdateCheckPeriodMinutes" -Value 240 -Type DWord
Set-ItemProperty -Path $policyPath -Name "UpdateDefault" -Value 1 -Type DWord   # Always allow updates
Set-ItemProperty -Path $policyPath -Name "DisableAutoUpdateChecksCheckboxValue" -Value 1 -Type DWord
Write-Host "Chrome update policy enforced."

# --- 3. Kill stale chrome processes to force relaunch into patched build ---
Get-Process chrome -ErrorAction SilentlyContinue | Stop-Process -Force
Write-Host "Chrome processes terminated to force relaunch on latest build."

# --- 4. Sweep common post-exploitation staging locations for recent drops ---
$lookback = (Get-Date).AddDays(-14)
$stagingDirs = @("$env:TEMP", "$env:LOCALAPPDATA\Temp", "$env:APPDATA", "C:\ProgramData", "C:\Users\Public")
$susExtensions = @("*.exe","*.dll","*.ps1","*.hta","*.scr")
foreach ($dir in $stagingDirs) {
    if (Test-Path $dir) {
        Get-ChildItem -Path $dir -Recurse -Include $susExtensions -ErrorAction SilentlyContinue |
            Where-Object { $_.CreationTime -gt $lookback -and $_.FullName -notmatch 'Google|Microsoft|OneDrive' } |
            ForEach-Object {
                $hash = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
                Write-Host "[ARTIFACT] $($_.FullName) | Created: $($_.CreationTime) | SHA256: $hash"
            }
    }
}

if ($issues.Count -gt 0) { $issues | ForEach-Object { Write-Host "[ISSUE] $_" }; exit 1 } else { exit 0 }