BlueMoon Exploit Kit Chains Chrome and Windows Zero-Days: Detection, Hunting, and Remediation Guide

---
title: Chrome Browser Spawning Shell or Script Interpreter
description: Detects chrome.exe spawning command shells, script engines, or LOLBins — consistent with a Chrome renderer exploit followed by a Windows sandbox escape, as used by the BlueMoon exploit kit.
references:
  - https://www.securityweek.com/bluemoon-exploit-kit-chains-recent-chrome-windows-zero-days/
  - https://attack.mitre.org/techniques/T1203/
  - https://attack.mitre.org/techniques/T1211/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1203
  - attack.t1211
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\chrome.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\schtasks.exe'
      - '\wmic.exe'
      - '\msbuild.exe'
      - '\installutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare enterprise browser extensions or SSO plugins that shell out to helper utilities — validate against known-good software inventory
level: critical
---
title: Suspicious Payload Execution from Browser or Temp Directories
description: Detects execution of binaries or scripts from user temp, AppData, or browser cache paths with Chrome as an ancestor — consistent with BlueMoon post-exploitation staging in rushed deployments.
references:
  - https://www.securityweek.com/bluemoon-exploit-kit-chains-recent-chrome-windows-zero-days/
  - https://attack.mitre.org/techniques/T1204.002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1204.002
  - attack.defense_evasion
logsource:
  category: process_creation
  product: windows
detection:
  selection_paths:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\ProgramData\'
      - '\Downloads\'
  selection_ext:
    Image|endswith:
      - '.exe'
      - '.dll'
      - '.bat'
      - '.ps1'
      - '.js'
      - '.vbs'
  filter_legit_updaters:
    Image|contains:
      - '\AppData\Local\Microsoft\Teams\'
      - '\AppData\Local\Google\'
      - '\AppData\Local\slack\'
      - '\AppData\Roaming\Zoom\'
  condition: selection_paths and selection_ext and not filter_legit_updaters
falsepositives:
  - User-mode application updaters (Slack, Teams, Zoom) — tune the filter list per environment
level: high
---
title: Persistence Created by Chrome Child Process
description: Detects registry Run-key modification or scheduled task creation where the responsible process descends from chrome.exe, indicating post-sandbox-escape persistence installation.
references:
  - https://www.securityweek.com/bluemoon-exploit-kit-chains-recent-chrome-windows-zero-days/
  - https://attack.mitre.org/techniques/T1547.001/
  - https://attack.mitre.org/techniques/T1053.005/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1547.001
  - attack.t1053.005
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - '\CurrentVersion\Run'
      - '\CurrentVersion\RunOnce'
      - '\Explorer\StartupApproved\Run'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wscript.exe'
  condition: selection
falsepositives:
  - Software installers registering autostart entries — correlate with preceding browser process tree
level: high

let Lookback = 14d;
let SuspiciousChildren = dynamic([
  "cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
  "mshta.exe", "rundll32.exe", "regsvr32.exe", "schtasks.exe", "wmic.exe",
  "msbuild.exe", "installutil.exe", "bitsadmin.exe", "certutil.exe"
]);
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName =~ "chrome.exe"
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, AccountName,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, SHA256, FolderPath
| extend TempPathExecution = FolderPath has_any ("\\Temp\\", "\\Public\\", "\\Downloads\\")
| order by TimeGenerated desc;
// Corroborate: persistence or external connections from the same devices within 1 hour
let SuspectDevices =
  DeviceProcessEvents
  | where TimeGenerated > ago(Lookback)
  | where InitiatingProcessFileName =~ "chrome.exe"
  | where FileName in~ (SuspiciousChildren)
  | summarize by DeviceName, bin(TimeGenerated, 1h);
DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where DeviceName in (SuspectDevices | distinct DeviceName)
| where InitiatingProcessFileName in~ (SuspiciousChildren)
| join kind=inner SuspectDevices on DeviceName
| project TimeGenerated, DeviceName, InitiatingProcessFileName,
          RemoteUrl, RemoteIP, RemotePort
| order by TimeGenerated desc;

-- Hunt: Chrome process spawning suspicious child processes (BlueMoon-style sandbox escape)
LET suspicious_children = '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|schtasks|wmic|bitsadmin|certutil)\.exe$'

LET chrome_pids = SELECT Pid, Name, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)^chrome\.exe$'

SELECT Pid, Name, CommandLine, Exe, Username, CreateTime,
       Ppid,
       hash(path=Exe).SHA256 AS ExeSHA256
FROM pslist()
WHERE Ppid in (SELECT Pid FROM chrome_pids)
  AND Name =~ suspicious_children

# BlueMoon Exploit Chain - Verification & Triage Script
# Run as Administrator. Review output before taking action.

# 1. Verify installed Chrome version against current stable channel
$chromePath = "${env:ProgramFiles}\Google\Chrome\Application\chrome.exe"
if (-not (Test-Path $chromePath)) { $chromePath = "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe" }
if (Test-Path $chromePath) {
    $ver = (Get-Item $chromePath).VersionInfo.ProductVersion
    Write-Host "[INFO] Installed Chrome version: $ver"
    Write-Host "[ACTION] Compare against https://chromereleases.googleblog.com/ and update immediately if behind."
} else {
    Write-Host "[WARN] Chrome not found in standard paths."
}

# 2. Force Chrome enterprise update policy (prevents users deferring patches)
$policyPath = "HKLM:\SOFTWARE\Policies\Google\Update"
if (-not (Test-Path $policyPath)) { New-Item -Path $policyPath -Force | Out-Null }
Set-ItemProperty -Path $policyPath -Name "AutoUpdateCheckPeriodMinutes" -Value 240
Set-ItemProperty -Path $policyPath -Name "UpdateDefault" -Value 1
Write-Host "[OK] Chrome auto-update enforced via policy (4-hour check interval)."

# 3. Check for pending reboot blocking browser/OS updates
$pendingReboot = Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending"
if ($pendingReboot) { Write-Host "[WARN] Pending reboot detected - patches may not be applied. Schedule restart." }

# 4. Audit Run keys for recently written persistence
$runKeys = @(
  "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
  "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
)
foreach ($key in $runKeys) {
    Get-ItemProperty -Path $key -ErrorAction SilentlyContinue |
      Select-Object * |
      Out-String | Write-Host "[AUDIT] $key :`n$_"
}

# 5. Find executables recently dropped into user-writable staging paths
$cutoff = (Get-Date).AddDays(-7)
$stagingPaths = @("$env:TEMP", "$env:PUBLIC", "$env:USERPROFILE\Downloads", "C:\ProgramData")
foreach ($p in $stagingPaths) {
    Get-ChildItem -Path $p -Recurse -Include *.exe,*.dll,*.ps1,*.bat -ErrorAction SilentlyContinue |
      Where-Object { $_.CreationTime -gt $cutoff } |
      Select-Object FullName, CreationTime, @{N='SHA256';E={(Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash}} |
      Format-Table -AutoSize | Out-String | Write-Host "[AUDIT] Recent files in $p :`n$_"
}

# 6. Confirm Windows OS cumulative update state
$os = Get-CimInstance Win32_OperatingSystem
Write-Host "[INFO] OS Build: $($os.BuildNumber).$($os | Select-Object -ExpandProperty Version)"
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 3 HotFixID, InstalledOn |
  Format-Table | Out-String | Write-Host "[INFO] Latest installed updates:`n$_"
Write-Host "[ACTION] Apply the latest Windows cumulative update immediately - it carries the Stage-2 sandbox-escape fix."