Browser-Based Attacks in the 2026 DBIR: Defending Against Malicious Extensions and Shadow AI

---
title: Potential Browser Native Messaging Abuse
id: 9c8e7f1a-2b3d-4c5e-9f0a-1b2c3d4e5f6a
status: experimental
description: Detects browser processes spawning unexpected child processes like PowerShell or CMD, often indicative of malicious extension Native Messaging hosts or exploits.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\firefox.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\regsvr32.exe'
  filter:
    # Filter out legitimate system updates or rare admin tools if necessary, but prioritize alerting
    CommandLine|contains:
      - '--type=gpu-process'
      - '--type=utility-process'
falsepositives:
  - Legitimate debugging by developers
  - Specific browser-based admin tools
level: high
---
title: Execution from Browser Extension Directory
id: a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects execution of binaries or scripts directly from browser extension directories. Malicious extensions often drop payloads here to bypass AppLocker.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - '\User Data\Default\Extensions\'
      - '\User Data\Profile 1\Extensions\'
falsepositives:
  - Native messaging hosts for legitimate accessibility tools (rare)
level: critical

// Hunt for browser processes spawning shells or suspicious utilities
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe")
| where FileName in~ ("powershell.exe", "cmd.exe", "pwsh.exe", "cscript.exe", "wscript.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine, FileName, FolderPath
| order by Timestamp desc

-- Hunt for recently modified browser extension directories
-- This helps identify suspicious extensions that may have been updated maliciously
SELECT FullPath, Mtime, Atime, Size
FROM glob(globs="/*/User Data/*/Extensions/*/*")
WHERE Mtime > now() - 7d
  -- Exclude standard clean runs or massive empty folders if needed
  AND Size > 0
ORDER BY Mtime DESC

<#
.SYNOPSIS
    Audit and Remediate Suspicious Browser Extensions.
.DESCRIPTION
    Checks registry for Force-installed extensions and scans Extension directories
    for unsigned or recently modified binaries. Requires Admin privileges.
#>

Write-Host "Starting Browser Security Audit..." -ForegroundColor Cyan

$ErrorActionPreference = "SilentlyContinue"

# Define paths
$ChromeBasePath = "$env:LOCALAPPDATA\Google\Chrome\User Data"
$EdgeBasePath = "$env:LOCALAPPDATA\Microsoft\Edge\User Data"
$SuspiciousProcesses = @("powershell.exe", "cmd.exe", "wscript.exe", "regsvr32.exe")

function Check-ExtensionFolder {
    param ($Path)
    if (Test-Path $Path) {
        Write-Host "Scanning: $Path" -ForegroundColor Yellow
        # Find executables in extension folders
        Get-ChildItem -Path $Path -Recurse -Include @("*.exe", "*.dll", "*.bat", "*.vbs") -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
        ForEach-Object {
            Write-Host "[!] Suspicious executable found in extension: $($_.FullName)" -ForegroundColor Red
            # Optional: Remove-Item $_.FullName -Force
        }
    }
}

# Scan Chrome and Edge Profiles
Get-ChildItem -Path "$ChromeBasePath\*\Extensions" -Directory -ErrorAction SilentlyContinue | ForEach-Object { Check-ExtensionFolder -Path $_.FullName }
Get-ChildItem -Path "$EdgeBasePath\*\Extensions" -Directory -ErrorAction SilentlyContinue | ForEach-Object { Check-ExtensionFolder -Path $_.FullName }

# Check for ForceInstalled policies (Common persistence)
$RegPaths = @(
    "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist",
    "HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist"
)

foreach ($Reg in $RegPaths) {
    if (Test-Path $Reg) {
        Write-Host "[WARNING] Force Install Policy found at $Reg" -ForegroundColor Magenta
        Get-ItemProperty $Reg
    }
}

Write-Host "Audit Complete." -ForegroundColor Green