Defending Against Chrome Sync Stalking and Game Cheat Supply Chain Attacks

---
title: Potential Game Cheat Spyware Execution
id: 8a2c4d1e-9f5a-4b3c-8a7d-1e2f3a4b5c6d
status: experimental
description: Detects unsigned processes spawned from common download directories or game paths that initiate network connections, typical of trojanized game loaders.
references:
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.initial_access
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains:
      - '\Downloads'
      - '\Desktop'
      - '\Games'
    Image|endswith:
      - '.exe'
    Signed: false
  condition: selection
falsepositives:
  - Legitimate unsigned game mods (rare in corporate environments)
level: high
---
title: Chrome Database Access by Non-Browser Process
id: 9b3d5e2f-0a6b-5c4d-9b8e-2f3a4b5c6d7e
status: experimental
description: Detects non-chrome processes accessing the Chrome 'History' or 'Cookies' database files, indicative of data theft or stalking tools.
references:
  - https://attack.mitre.org/techniques/T1005/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\Google\Chrome\User Data\Default\History'
      - '\Google\Chrome\User Data\Default\Cookies'
    Image|notcontains:
      - '\chrome.exe'
      - '\chrome_proxy.exe'
  condition: selection
falsepositives:
  - Backup software or security scanners accessing browser data
level: medium
---
title: Rapid File Encryption Activity
id: 0c4e6f3a-1b7c-6d5e-0c9f-3a4b5c6d7e8f
status: experimental
description: Detects bulk modification or deletion of files with extensions commonly targeted by ransomware within a short timeframe.
references:
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: file_change
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '.doc'
      - '.pdf'
      - '.jpg'
      - '.enc'
    Image|endswith:
      - '.exe'
  filter:
    Image|contains:
      - '\Program Files'
      - '\Program Files (x86)'
  condition: selection and not filter
falsepositives:
  - Legitimate bulk file conversion tools
level: critical

// Hunt for unsigned binaries originating from user directories initiating network connections
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FolderPath startswith @"C:\Users\" and (FolderPath contains @"Downloads" or FolderPath contains @"Desktop")
| where isnull(Signer) or Signer != "Microsoft Corporation"
| join kind=inner (DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessVersionInfoCompanyName != "Microsoft Corporation")
$on DeviceId, InitiatingProcessId
| project Timestamp, DeviceName, AccountName, FolderPath, FileName, RemoteUrl, RemoteIP

-- Hunt for suspicious access to Chrome User Data (Stalking/Spyware indicators)
SELECT FullPath, Size, Mtime, Atime, Mode
FROM glob(globs='/*/AppData/Local/Google/Chrome/User Data/Default/*')
WHERE Mode != 'drwxrwxrwx' AND Name =~ '(History|Cookies|Login Data)'
-- Check handles opened to these files by non-chrome processes
SELECT Pid, Name, CommandLine, Exe
FROM pslist()
WHERE Exe NOT =~ 'chrome.exe'
  AND Exe NOT =~ 'Program Files'
  AND Exe NOT =~ 'Windows'

# Harden Chrome Sync and Scan for common cheat spyware paths

Write-Host "Checking Chrome Sync Policies..."
$RegPath = "HKLM:\SOFTWARE\Policies\Google\Chrome"
if (-not (Test-Path $RegPath)) {
    New-Item -Path $RegPath -Force | Out-Null
}
# Disable Sync Roaming (Mitigation for Stalking)
Set-ItemProperty -Path $RegPath -Name "SyncDisabled" -Value 1 -Type DWord -Force
Write-Host "Chrome Sync has been disabled via policy."

Write-Host "Scanning for unsigned executables in common user directories..."
$Paths = @("$env:USERPROFILE\Downloads", "$env:USERPROFILE\Desktop", "$env:USERPROFILE\AppData\Local\Temp")
$SuspiciousFiles = @()

foreach ($Path in $Paths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Filter "*.exe" -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $sig = Get-AuthenticodeSignature -FilePath $_.FullName
            if ($sig.Status -ne "Valid") {
                $SuspiciousFiles += $_.FullName
            }
        }
    }
}

if ($SuspiciousFiles.Count -gt 0) {
    Write-Host "[WARNING] Found unsigned executables:" -ForegroundColor Yellow
    $SuspiciousFiles | ForEach-Object { Write-Host $_ -ForegroundColor Red }
} else {
    Write-Host "No unsigned executables found in monitored paths."
}