---
title: Suspicious Child Process Launched from Web Browser
id: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects web browsers launching suspicious installers or script hosts often triggered by malvertising or scam downloads.
references:
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2024/05/21
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\opera.exe'
      - '\brave.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\msiexec.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  filter:
    CommandLine|contains:
      - 'software\reporter\tool\'
      - 'remotedebuggingport'
      - '--type=renderer'
condition: selection and not filter
falsepositives:
  - Legitimate software downloads initiated by users
level: medium
---
title: Potential Fake Finance or Crypto Installer Execution
id: b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects execution of installers containing keywords commonly found in fake crypto or trading scam applications distributed via social ads.
references:
  - https://attack.mitre.org/techniques/T1566/
author: Security Arsenal
date: 2024/05/21
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\msiexec.exe'
      - '\update.exe'
      - '\setup.exe'
  keywords:
    CommandLine|contains:
      - 'crypto'
      - 'trading'
      - 'wallet'
      - 'miner'
      - 'profit'
      - 'investment'
  user_path:
    CurrentDirectory|contains:
      - '\Temp\'
      - '\Downloads\'
condition: selection and keywords and user_path
falsepositives:
  - Legitimate installation of trading or financial software
level: high

DeviceProcessEvents
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "opera.exe")
| where FileName in~ ("powershell.exe", "cmd.exe", "msiexec.exe", "wscript.exe", "regsvr32.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath
| order by Timestamp desc


Search for potential network connections to known malvertising infrastructure or suspicious TLDs:

DeviceNetworkEvents
| where RemotePort in (443, 80)
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe")
| where RemoteUrl contains ".xyz" or RemoteUrl contains ".top" or RemoteUrl contains ".gq"
| summarize count() by DeviceName, RemoteUrl, AccountName
| order by count_ desc

-- Hunt for suspicious browser child processes
SELECT Pid, Ppid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Ppid in (
    SELECT Pid FROM pslist()
    WHERE Name =~ "chrome.exe" OR Name =~ "msedge.exe" OR Name =~ "firefox.exe" OR Name =~ "opera.exe"
)
AND (Name =~ "cmd.exe" OR Name =~ "powershell.exe" OR Name =~ "msiexec.exe" OR Name =~ "wscript.exe")


Hunt for recent executable downloads in user directories that match common scam naming patterns:

-- Hunt for suspicious executables in Downloads folders
SELECT FullPath, Mtime, Size, Name
FROM glob(globs="C:/Users/*/Downloads/*.exe")
WHERE Mtime > now() - 24h
   AND (Name =~ "wallet" OR Name =~ "crypto" OR Name =~ "miner" OR Name =~ "trading")

# Audit Recent Downloads for Suspicious Executables
$DaysToCheck = 7
$SuspiciousKeywords = @("crypto", "trading", "wallet", "miner", "profit", "setup", "update")

Get-ChildItem -Path "C:\Users" -Recurse -ErrorAction SilentlyContinue |
    Where-Object { $_.Extension -eq ".exe" -and $_.LastWriteTime -gt (Get-Date).AddDays(-$DaysToCheck) } |
    Where-Object { $_.DirectoryName -like "*Downloads*" -or $_.DirectoryName -like "*Temp*" } |
    Where-Object { $SuspiciousKeywords | Where-Object { $_.Name -like "*$($_)*" } } |
    Select-Object FullName, LastWriteTime, Length, @{Name="User";Expression={(Get-Acl $_.FullName).Owner}} |
    Format-Table -AutoSize


# Remediation

Defending against malvertising requires a layered defense approach:

1.  **DNS Filtering:** Implement enterprise-grade DNS filtering (e.g., Cisco Umbrella, Quad9) to block domains known to host phishing kits or malware distribution servers associated with scam ads.
2.  **Browser Isolation:** Consider using Remote Browser Isolation (RBI) for high-risk users. This executes web code in a secure cloud environment, preventing malicious downloads from reaching the endpoint.
3.  **Endpoint Detection & Response (EDR):** Ensure EDR policies are tuned to detect "LOLBins" (Living Off The Land Binaries) spawned by browser processes, as this is a common technique used in fake installers.
4.  **Application Allowlisting:** Where possible, restrict the ability of users to install software from unverified sources. Block execution of MSI and EXE files from `%AppData%` and `%Temp%` directories.
5.  **Security Awareness Training:** Educate employees specifically about the risks of sponsored content on social media. Teach them to verify URLs manually rather than trusting ads, even if they appear on reputable platforms.