BlueMoon Exploit Kit: Four Espionage Groups Chained Chrome and Windows Flaws — Detection and Hardening Guide

---
title: Chrome Browser Process Spawning Command Interpreter or Script Host
id: 3f8c1a92-7d4e-4b6a-9c21-5e8f0a2b7d91
status: experimental
description: Detects chrome.exe spawning cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, or rundll32.exe. Consistent with post-exploitation behavior from browser exploit kits such as BlueMoon, where a compromised renderer or sandbox-escaped process executes attacker payloads.
references:
  - https://thehackernews.com/2026/09/four-spy-groups-used-same-chrome-and.html
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\chrome.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare enterprise browser extensions or internal tooling that shell out from Chrome (verify before tuning)
level: critical
---
title: Payload Execution from User Temp or AppData Following Browser Activity
id: 9a2d4e71-6c3b-4f58-b802-1d7e5c9a3f46
status: experimental
description: Detects execution of binaries or scripts from user-writable Temp/AppData locations where the parent process is a web browser. Browser exploit chains such as BlueMoon commonly stage second-stage payloads in user-writable directories after sandbox escape.
references:
  - https://thehackernews.com/2026/09/four-spy-groups-used-same-chrome-and.html
  - https://attack.mitre.org/techniques/T1204.002/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.t1203
  - attack.defense_evasion
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\ProgramData\'
  filter_signed_updates:
    - Description: 'Google Update'
    - Description: 'Microsoft Edge Update'
  condition: selection_path and not 1 of filter_signed_updates*
falsepositives:
  - Browser auto-updaters executing from AppData (filtered by description; tune per environment)
  - Legitimate user-installed applications running from AppData (e.g., Teams, Slack) - consider excluding known enterprise paths
level: high
---
title: Persistence via Run Key or Scheduled Task Created by Browser-Spawned Process
id: 5c7e2b18-3a9f-4d64-8e13-7b2f9d4c6a85
status: experimental
description: Detects registry Run key modification or scheduled task creation where the responsible process lineage includes chrome.exe. Espionage operators using browser exploit kits establish persistence immediately after privilege escalation.
references:
  - https://thehackernews.com/2026/09/four-spy-groups-used-same-chrome-and.html
  - https://attack.mitre.org/techniques/T1547.001/
  - https://attack.mitre.org/techniques/T1053.005/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.persistence
  - attack.t1547.001
  - attack.t1053.005
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - '\CurrentVersion\Run'
      - '\CurrentVersion\RunOnce'
  condition: selection
falsepositives:
  - Software installers and updaters writing Run keys - correlate with process lineage and alert on browser-adjacent ancestry only if telemetry supports it
level: medium

// Hunt: Chrome spawning LOLBins or script interpreters (BlueMoon post-exploitation pattern)
// Scope: last 7 days. Extend lookback if you suspect historical compromise.
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "chrome.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
                     "mshta.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe", "bitsadmin.exe",
                     "schtasks.exe", "sc.exe", "net.exe", "whoami.exe")
| project TimeGenerated, DeviceName, AccountName,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, SHA256, ReportId
| order by TimeGenerated desc

// Correlation hunt: browser-spawned process followed by persistence or network egress
// Joins suspicious child processes with subsequent outbound connections on the same device
let SuspiciousBrowserChildren =
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "rundll32.exe", "regsvr32.exe")
| summarize FirstSeen=min(TimeGenerated) by DeviceName, AccountName, ChildProcess=FileName, ChildCmd=ProcessCommandLine;
SuspiciousBrowserChildren
| join kind=inner (
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemoteUrl !has_any ("microsoft.com", "google.com", "windowsupdate.com")
    | summarize EgressConnections=make_set(RemoteUrl, 20) by DeviceName
) on DeviceName
| project DeviceName, AccountName, FirstSeen, ChildProcess, ChildCmd, EgressConnections

-- Artifact: SecurityArsenal.Hunt.BrowserExploitChain
-- Hunts for command interpreters and script hosts spawned by browser processes,
-- indicative of post-exploitation activity from kits such as BlueMoon.

SELECT Pid,
       Ppid,
       Name,
       Exe,
       CommandLine,
       Username,
       CreateTime,
       get(field='pslist') AS _ignored
FROM pslist()
WHERE Ppid IN (
    SELECT Pid
    FROM pslist()
    WHERE Name =~ '(?i)chrome|msedge|firefox'
)
AND Name =~ '(?i)cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|wmic|schtasks'

-- Artifact: SecurityArsenal.Hunt.RunKeyPersistence
-- Collects Run/RunOnce persistence entries for triage after a suspected browser compromise.

SELECT Name,
       value.value AS ValueData,
       full_path AS KeyPath,
       Mtime
FROM glob(globs='HKEY_USERS\*\Software\Microsoft\Windows\CurrentVersion\Run*\*',
          accessor='registry')
ORDER BY Mtime DESC

# Security Arsenal - BlueMoon Exposure Verification & Hardening
# Run elevated. Verifies Chrome patch level, pending Windows updates,
# and applies defensive hardening for browser exploit chains.

# --- 1. Chrome version check (fleet should be on the latest Stable channel) ---
$chromePath = "$env:ProgramFiles\Google\Chrome\Application\chrome.exe"
if (Test-Path $chromePath) {
    $chromeVersion = (Get-Item $chromePath).VersionInfo.ProductVersion
    Write-Host "[+] Chrome installed version: $chromeVersion"
    Write-Host "[!] ACTION: Compare against the current Stable channel release at https://chromereleases.googleblog.com/ and force update if behind."
} else {
    Write-Host "[-] Chrome not found at default path - check per-user installs at $env:LOCALAPPDATA\Google\Chrome"
}

# --- 2. Pending Windows security updates ---
Write-Host "`n[+] Checking for pending Windows security updates..."
$session = New-Object -ComObject Microsoft.Update.Session
$searcher = $session.CreateUpdateSearcher()
try {
    $pending = $searcher.Search("IsInstalled=0 and Type='Software'").Updates
    Write-Host "[!] Pending updates: $($pending.Count)"
    $pending | ForEach-Object { Write-Host "    - $($_.Title)" }
} catch {
    Write-Host "[-] Update search failed (WSUS-managed or offline host): $_"
}

# --- 3. Chrome hardening via policy: block third-party extensions & enforce site isolation ---
$chromePolicy = "HKLM:\SOFTWARE\Policies\Google\Chrome"
if (-not (Test-Path $chromePolicy)) { New-Item -Path $chromePolicy -Force | Out-Null }
Set-ItemProperty -Path $chromePolicy -Name "DefaultJavaScriptJitSetting" -Value 2  # Disable JIT on untrusted sites where operationally feasible
Set-ItemProperty -Path $chromePolicy -Name "SitePerProcess" -Value 1               # Enforce site isolation
Write-Host "`n[+] Chrome hardening policies applied (JIT restriction, site isolation)."

# --- 4. Audit: recent Run key writes in the last 7 days for triage ---
Write-Host "`n[+] Run key entries modified in last 7 days (triage for persistence):"
$cutoff = (Get-Date).AddDays(-7)
$runKeys = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
)
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-ItemProperty -Path $key | Select-Object -Property * |
        Out-String | Write-Host
    }
}
Write-Host "[!] Correlate any unexpected entries with browser process lineage in your EDR."