Claude Dispatch Browser Extension Attack Chain: Detecting and Blocking Malicious Code Execution on Endpoints

[Malicious Browser Extension]
        │  (content script injection / DOM manipulation on claude.ai)
        ▼
[claude.ai Web Session] ── forged or manipulated task input
        │  (Dispatch relay: cloud-brokered task delivery)
        ▼
[Claude Desktop on endpoint] ── interprets task as legitimate user instruction
        │  (agent executes: shell commands, script files, downloads)
        ▼
[Local Code Execution] ── cmd.exe / powershell.exe / sh / osascript / dropped payloads

---
title: Claude Desktop Spawning Shell or Scripting Interpreter
id: 3f8a2c71-9b4e-4d5a-a6c2-7e1f8b3d9a42
status: experimental
description: Detects Claude Desktop spawning command shells or scripting engines, consistent with agent-driven local code execution such as the Dispatch browser-extension attack chain demonstrated by Forever Security.
references:
  - https://thehackernews.com/2026/11/malicious-browser-extensions-could-use.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\Claude.exe'
      - '\claude.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\bitsadmin.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate Claude Desktop tool-use features invoking shells under user direction; baseline frequency per host before tuning
level: high
---
title: Claude Desktop Writing Executable or Script Files to User-Writable Paths
id: 8c4d1e92-5a3b-4f6c-b7d1-2a9e4c6f8b35
status: experimental
description: Detects Claude Desktop dropping scripts or executables into temp, downloads, or appdata paths, a likely artifact of an agent executing an injected task from the Dispatch relay.
references:
  - https://thehackernews.com/2026/11/malicious-browser-extensions-could-use.html
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: file_event
  product: windows
detection:
  selection_source:
    Image|endswith:
      - '\Claude.exe'
      - '\claude.exe'
  selection_target:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\Downloads\'
      - '\AppData\Roaming\'
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.ps1'
      - '.bat'
      - '.cmd'
      - '.vbs'
      - '.js'
      - '.hta'
  condition: selection_source and selection_target
falsepositives:
  - User-directed code generation workflows where Claude legitimately writes project files; restrict to non-project directories during tuning
level: medium
---
title: Claude Desktop Process Establishing Outbound Connection to Raw Payload Infrastructure
id: 1b7e3f54-6c2a-4d8e-9a1b-5f3c7d2e8a16
status: experimental
description: Detects Claude Desktop making network connections to uncommon non-Anthropic destinations, potentially indicating an agent fetching second-stage payloads after a Dispatch-injected task.
references:
  - https://thehackernews.com/2026/11/malicious-browser-extensions-could-use.html
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\Claude.exe'
      - '\claude.exe'
    Initiated: 'true'
  filter_anthropic:
    DestinationHostname|endswith:
      - '.anthropic.com'
      - '.claude.ai'
  condition: selection and not filter_anthropic
falsepositives:
  - MCP server integrations and legitimate tool connectors configured by the user; inventory sanctioned connectors and extend the filter
level: medium

// Hunt: Suspicious child processes spawned by Claude Desktop (Dispatch abuse indicator)
// Covers both the direct shell-spawn pattern and script-interpreter lineage.
let Lookback = 14d;
let SuspiciousChildren = dynamic([
    "cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
    "mshta.exe", "rundll32.exe", "regsvr32.exe", "bitsadmin.exe", "certutil.exe",
    "wmic.exe", "schtasks.exe", "curl.exe"
]);
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName =~ "Claude.exe"
   or InitiatingProcessFolderPath has_any ("Claude")
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, AccountName,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, SHA256, FolderPath
| order by TimeGenerated desc;

// Companion hunt: network connections from Claude Desktop to non-Anthropic destinations
DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName =~ "Claude.exe"
| where not(RemoteUrl has_any ("anthropic.com", "claude.ai"))
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
          by DeviceName, RemoteUrl, RemoteIP, RemotePort
| order by ConnectionCount asc;  // low-frequency destinations are the interesting ones

-- Hunt for Claude Desktop child process lineage across the fleet
-- Deploy as a multi-client hunt to identify hosts where the agent
-- has spawned shells or scripting interpreters (Dispatch abuse artifact)

SELECT Pid,
       Ppid,
       Name,
       Exe,
       CommandLine,
       Username,
       CreateTime,
       get_member(field="Exe", member="Authenticode") AS Signature
FROM pslist()
WHERE Ppid IN (
        SELECT Pid FROM pslist()
        WHERE Name =~ '(?i)claude'
      )
  AND Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|curl|wget|bash|sh)'

-- Inventory browser extensions with claude.ai host permissions (Chrome, fleet-wide)
-- Parses each profile's Secure Preferences for extension host permissions

SELECT FullPath AS ExtensionID,
       parse_json(data=read_file(filename=FullPath)).name AS ExtensionName,
       parse_json(data=read_file(filename=FullPath)).permissions AS Permissions
FROM glob(globs='C:/Users/*/AppData/Local/Google/Chrome/User Data/*/Extensions/*/*/manifest.json')
WHERE read_file(filename=FullPath) =~ 'claude\\.ai'

# Security Arsenal - Claude Dispatch Exposure Audit & Hardening Script
# Run elevated on endpoints. Audits Claude Desktop child-process history,
# inventories Chrome/Edge extensions with claude.ai permissions, and
# reports Dispatch configuration state.

$ReportPath = "C:\ProgramData\SecurityArsenal\ClaudeDispatchAudit_$(Get-Date -Format 'yyyyMMdd_HHmmss').log"
New-Item -ItemType Directory -Path (Split-Path $ReportPath) -Force | Out-Null

function Write-Finding($Message) {
    $line = "$(Get-Date -Format 'u') $Message"
    Add-Content -Path $ReportPath -Value $line
    Write-Host $line
}

Write-Finding "=== Claude Dispatch Exposure Audit Started ==="

# 1. Check whether Claude Desktop is installed
$claudePaths = @(
    "$env:LOCALAPPDATA\Programs\Claude\Claude.exe",
    "$env:LOCALAPPDATA\AnthropicClaude\Claude.exe"
)
$claudeInstalled = $claudePaths | Where-Object { Test-Path $_ }
if ($claudeInstalled) {
    Write-Finding "[FOUND] Claude Desktop installed at: $($claudeInstalled -join ', ')"

    # Check if the process is currently running
    $running = Get-Process -Name "Claude" -ErrorAction SilentlyContinue
    if ($running) {
        Write-Finding "[ALERT] Claude Desktop is currently RUNNING (PID(s): $($running.Id -join ', '))"
    }

    # 2. Audit running child processes of Claude (live snapshot)
    $claudePids = (Get-Process -Name "Claude" -ErrorAction SilentlyContinue).Id
    if ($claudePids) {
        $children = Get-CimInstance Win32_Process |
            Where-Object { $claudePids -contains $_.ParentProcessId }
        foreach ($child in $children) {
            Write-Finding "[REVIEW] Claude child process: $($child.Name) | PID $($child.ProcessId) | CmdLine: $($child.CommandLine)"
        }
        if (-not $children) { Write-Finding "[OK] No active child processes under Claude." }
    }
} else {
    Write-Finding "[OK] Claude Desktop not found on this host."
}

# 3. Inventory Chrome extensions requesting claude.ai host permissions
$extRoot = "$env:LOCALAPPDATA\Google\Chrome\User Data"
if (Test-Path $extRoot) {
    $manifests = Get-ChildItem -Path $extRoot -Recurse -Filter "manifest.json" -ErrorAction SilentlyContinue |
        Where-Object { $_.FullName -match '\\Extensions\\' }
    foreach ($m in $manifests) {
        $raw = Get-Content $m.FullName -Raw -ErrorAction SilentlyContinue
        if ($raw -match 'claude\.ai') {
            $json = $raw | ConvertFrom-Json -ErrorAction SilentlyContinue
            Write-Finding "[EXTENSION] Name: $($json.name) | Path: $($m.FullName)"
        }
    }
}

# 4. Inventory Edge extensions with the same check
$edgeExtRoot = "$env:LOCALAPPDATA\Microsoft\Edge\User Data"
if (Test-Path $edgeExtRoot) {
    $edgeManifests = Get-ChildItem -Path $edgeExtRoot -Recurse -Filter "manifest.json" -ErrorAction SilentlyContinue |
        Where-Object { $_.FullName -match '\\Extensions\\' }
    foreach ($m in $edgeManifests) {
        $raw = Get-Content $m.FullName -Raw -ErrorAction SilentlyContinue
        if ($raw -match 'claude\.ai') {
            $json = $raw | ConvertFrom-Json -ErrorAction SilentlyContinue
            Write-Finding "[EDGE-EXTENSION] Name: $($json.name) | Path: $($m.FullName)"
        }
    }
}

# 5. Optional hardening: block Claude Desktop via AppLocker (uncomment to enforce)
# NOTE: Pilot first. This blocks execution entirely for standard users.
# New-AppLockerPolicy -RuleTypes Publisher -XmlPolicy "C:\temp\baseline.xml"
# Then add a DENY publisher rule for Anthropic Claude.exe if org policy prohibits agentic AI desktop tools.

Write-Finding "=== Audit Complete. Review findings above. ==="
Write-Host "`nReport written to: $ReportPath" -ForegroundColor Cyan