Browser-Based Attacks in 2026: Detection and Defense Guide for the Six Techniques Breaching Enterprise Perimeters

---
title: ClickFix-Style User-Launched Script Interpreter with Download Cradle
id: 3f9c1a72-8b2d-4e51-9c47-6a2d8f10b3e5
status: experimental
description: Detects script interpreters launched with encoded or download-cradle command lines characteristic of ClickFix fake CAPTCHA lures, where the user is tricked into pasting a command into the Run dialog. Keys on command content rather than parent process, since the user launches the process directly.
references:
  - https://thehackernews.com/2026/09/know-your-enemy-browser-based-attack.html
  - https://attack.mitre.org/techniques/T1204/
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.initial_access
  - attack.t1204
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  selection_cli:
    CommandLine|contains:
      - ' -enc '
      - ' -e '
      - 'FromBase64String'
      - 'IEX'
      - 'Invoke-Expression'
      - 'Invoke-WebRequest'
      - 'wget '
      - 'curl '
      - 'Start-BitsTransfer'
      - 'hidden'
  filter_legit:
    CommandLine|contains:
      - 'Invoke-WebRequest -Uri https://aka.ms/'
      - 'Microsoft.PowerShell_profile.ps1'
  condition: selection_img and selection_cli and not filter_legit
falsepositives:
  - Software deployment tooling and admin scripts using encoded commands; tune the filter to your deployment tooling
level: high
---
title: Browser Process Writing Executable Content to User Directories
id: 8d2e5b91-4c7a-4f38-a156-9e3c7d02f841
status: experimental
description: Detects browser processes writing executables, scripts, or disk images to user-writable locations, consistent with HTML smuggling payload assembly and malicious download staging.
references:
  - https://thehackernews.com/2026/09/know-your-enemy-browser-based-attack.html
  - https://attack.mitre.org/techniques/T1027/006/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.defense_evasion
  - attack.t1027.006
  - attack.t1204.002
logsource:
  category: file_event
  product: windows
detection:
  selection_browser:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
  selection_target:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.js'
      - '.jse'
      - '.vbs'
      - '.hta'
      - '.lnk'
      - '.iso'
      - '.bat'
      - '.ps1'
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\Downloads\'
      - '\AppData\Roaming\'
  filter_ext:
    TargetFilename|contains:
      - '\AppData\Local\Google\Chrome\'
      - '\AppData\Local\Microsoft\Edge\'
      - '\AppData\Local\Mozilla\'
  condition: selection_browser and selection_target and selection_path and not filter_ext
falsepositives:
  - Legitimate software downloads by users; pair with execution correlation before escalating
level: medium
---
title: Suspicious Browser Extension Install via Preferences Tampering
id: 5a71c3e6-2d94-4b08-8f23-1c9a6e54d7b2
status: experimental
description: Detects non-browser processes modifying Chrome or Edge extension directories or Secure Preferences, indicative of forced extension installation or extension tampering by malware.
references:
  - https://thehackernews.com/2026/09/know-your-enemy-browser-based-attack.html
  - https://attack.mitre.org/techniques/T1176/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.persistence
  - attack.t1176
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Google\Chrome\User Data\'
      - '\Microsoft\Edge\User Data\'
  selection_file:
    TargetFilename|endswith:
      - '\Secure Preferences'
      - '\Preferences'
      - '\manifest.json'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
  condition: selection_path and selection_file and not filter_browsers
falsepositives:
  - Enterprise extension management tooling (GPO-driven deployment is registry-based, not direct file writes); backup/restore utilities
level: high

// Hunt: ClickFix-style user-launched script interpreters with download cradles
// and follow-on network connections, plus browser-written executables.
// Tables: DeviceProcessEvents, DeviceFileEvents, DeviceNetworkEvents (Defender for Endpoint / Sentinel)

let lookback = 7d;
let suspiciousCli = dynamic(["-enc", "FromBase64String", "IEX", "Invoke-Expression",
    "Invoke-WebRequest", "Start-BitsTransfer", "mshta http", "curl ", "wget "]);
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName in~ ("powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe", "rundll32.exe")
| where ProcessCommandLine has_any (suspiciousCli)
// User-launched (Run dialog/Explorer) rather than spawned by browser or Office
| where InitiatingProcessFileName in~ ("explorer.exe", "svchost.exe", "cmd.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessId, SHA256
| join kind=leftouter (
    DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | project ProcessId, DeviceName, RemoteUrl, RemoteIP, RemotePort, ActionType
) on ProcessId, DeviceName
| project-away ProcessId1, DeviceName1
| order by TimeGenerated desc;

// Companion hunt: browsers dropping executable/script content into user paths
DeviceFileEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe")
| where FolderPath has_any ("\\Downloads\\", "\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\")
| where FileName endswith_any (".exe", ".dll", ".js", ".hta", ".lnk", ".iso", ".bat", ".ps1")
| where FolderPath !has_any ("\\Google\\Chrome\\", "\\Microsoft\\Edge\\", "\\Mozilla\\")
| join kind=leftouter (
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | project DeviceName, FileName, ProcessCommandLine, TimeGenerated
) on DeviceName, FileName
| project TimeGenerated, DeviceName, FolderPath, FileName, SHA256,
          InitiatingProcessFileName, ProcessCommandLine
| order by TimeGenerated desc;

-- Artifact: Browser-Based Attack Surface Hunt
-- Enumerates installed browser extensions (Chrome/Edge), unsigned or non-system
-- script interpreters with suspicious command lines, and browser-established
-- network connections to uncommon destinations.

LET extensions = SELECT
    FullPath AS ExtensionManifest,
    B.Name AS Browser,
    basename(path=dirname(path=FullPath)) AS ExtensionID
FROM glob(
    globs=[
        'C:/Users/*/AppData/Local/Google/Chrome/User Data/*/Extensions/*/*/manifest.json',
        'C:/Users/*/AppData/Local/Microsoft/Edge/User Data/*/Extensions/*/*/manifest.json'
    ])
LET Browser = parse_string_with_regex(
    string=ExtensionManifest,
    regex='(?P<b>Chrome|Edge)').b

LET suspicious_procs = SELECT
    Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)powershell|pwsh|mshta|wscript|cscript'
  AND CommandLine =~ '(?i)(-enc|FromBase64String|IEX|Invoke-Expression|Invoke-WebRequest|Start-BitsTransfer|http)'

LET browser_conns = SELECT
    Pid, Name, Raddr AS RemoteAddress, Rport AS RemotePort, Status
FROM netstat()
WHERE Name =~ '(?i)chrome|msedge|firefox'
  AND Status =~ 'ESTAB'
  AND Rport =~ '^(80|443)$'
  AND Raddr !~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)'

SELECT * FROM extensions
UNION ALL
SELECT NULL, NULL, NULL, * FROM suspicious_procs

# Browser-Based Attack Hardening & Audit Script
# Run elevated. Audits extensions, applies ClickFix mitigations, and checks MOTW handling.

$report = @()

# 1. Enumerate all installed Chrome/Edge extensions across user profiles
Write-Host "[+] Enumerating browser extensions..." -ForegroundColor Cyan
$extPaths = @(
    "$env:LOCALAPPDATA\Google\Chrome\User Data\*\Extensions\*\*\manifest.json",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\*\Extensions\*\*\manifest.json",
    "C:\Users\*\AppData\Local\Google\Chrome\User Data\*\Extensions\*\*\manifest.json",
    "C:\Users\*\AppData\Local\Microsoft\Edge\User Data\*\Extensions\*\*\manifest.json"
)
foreach ($p in $extPaths) {
    Get-ChildItem -Path $p -ErrorAction SilentlyContinue | ForEach-Object {
        try {
            $m = Get-Content $_.FullName -Raw | ConvertFrom-Json
            $perms = ($m.permissions + $m.host_permissions) -join ","
            $risky = $perms -match "cookies|webRequest|<all_urls>|tabs|clipboardRead"
            $report += [PSCustomObject]@{
                Extension = ($_.FullName -split '\\')[-3]
                Path      = $_.FullName
                RiskyPerms = $risky
                Permissions = $perms
            }
        } catch {}
    }
}
$report | Where-Object RiskyPerms | Format-Table -AutoSize
$report | Export-Csv "$env:TEMP\extension-audit.csv" -NoTypeInformation
Write-Host "[+] Full audit written to $env:TEMP\extension-audit.csv" -ForegroundColor Green

# 2. Enforce extension allowlisting via policy (Chrome + Edge)
#    Replace the example IDs with your approved extension list.
$chromeKey = "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist"
$edgeKey   = "HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallAllowlist"
$approved  = @("ghbmnnjooekpmoecnnnilnnbdlolhkhi")  # example: Google Docs Offline
foreach ($key in @($chromeKey, $edgeKey)) {
    New-Item -Path $key -Force | Out-Null
    $i = 1
    foreach ($id in $approved) {
        Set-ItemProperty -Path $key -Name $i -Value $id
        $i++
    }
    # Block all extensions not on the allowlist
    $blockKey = $key -replace 'ExtensionInstallAllowlist','ExtensionInstallBlocklist'
    New-Item -Path $blockKey -Force | Out-Null
    Set-ItemProperty -Path $blockKey -Name "1" -Value "*"
}
Write-Host "[+] Extension allowlist/blocklist policy applied (Chrome + Edge)" -ForegroundColor Green

# 3. ClickFix mitigation: block Run dialog + enforce MOTW zone checking
$runKey = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer"
New-Item -Path $runKey -Force | Out-Null
Set-ItemProperty -Path $runKey -Name "NoRun" -Value 1 -Type DWord
Write-Host "[+] Run dialog disabled for current user (ClickFix kill-chain break)" -ForegroundColor Green

$zoneKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Attachments"
New-Item -Path $zoneKey -Force | Out-Null
Set-ItemProperty -Path $zoneKey -Name "SaveZoneInformation" -Value 2 -Type DWord
Write-Host "[+] Mark-of-the-Web preservation enforced for downloaded files" -ForegroundColor Green

# 4. Verify PowerShell Script Block Logging is enabled (for post-ClickFix forensics)
$sbl = Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -ErrorAction SilentlyContinue
if (-not $sbl -or $sbl.EnableScriptBlockLogging -ne 1) {
    New-Item "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Force | Out-Null
    Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1
    Write-Host "[+] PowerShell Script Block Logging enabled" -ForegroundColor Green
} else {
    Write-Host "[=] Script Block Logging already enabled" -ForegroundColor Yellow
}

Write-Host "`n[+] Done. Review extension-audit.csv and triage entries with cookies/webRequest/<all_urls> permissions." -ForegroundColor Cyan