Detecting msaRAT: Defending Against Chrome & Edge C2 Tunneling

Security operations teams must adapt to the Chaos cybercrime gang's latest evolution in evasion tactics. The group has deployed a new .NET-based Remote Access Trojan (RAT), dubbed msaRAT, designed specifically to bypass traditional network egress controls. Instead of opening raw sockets or utilizing uncommon ports, msaRAT hijacks installed instances of Google Chrome or Microsoft Edge to route its Command and Control (C2) communications.

By leveraging trusted browsers as proxies, the malware blends malicious traffic into the noise of legitimate web browsing. Standard firewalls and DLP solutions, configured to allow chrome.exe and msedge.exe unrestricted access to the internet, will likely fail to flag this intrusion. This post provides the technical breakdown and detection logic required to hunt for this threat in your environment.

Technical Analysis

Threat Actor: Chaos Gang Malware: msaRAT (Java/.NET variant) Platform: Windows

Attack Chain & Mechanics: msaRAT represents a "Living off the Land" (LotL) approach to C2 infrastructure. Once executed on a victim host—typically delivered via phishing or credential stuffing—the malware performs the following steps:

1. Process Discovery: It scans the system for running instances of chrome.exe or msedge.exe.
2. Code Injection / Hooking: The malware injects malicious code or utilizes browser automation interfaces (such as the Chrome DevTools Protocol) to manipulate the browser process.
3. C2 Tunneling: Instead of initiating its own TCP connections, msaRAT forces the compromised browser process to establish HTTPS connections to the attacker's infrastructure. To the network perimeter, this traffic appears as a standard user browsing a website.
4. Data Exfiltration: Commands and data are encapsulated within the browser's legitimate SSL/TLS tunnels, rendering packet inspection ineffective without deep SSL decryption capabilities.

Why This Matters: This technique renders network-based IP and domain blocklists largely ineffective if the C2 domain resembles a high-reputation web service or uses fast-flux infrastructure. The compromise is hidden in plain sight, requiring endpoint telemetry rather than just network logs for accurate detection.

Detection & Response

Detecting browser-hijacking RATs requires shifting focus from network attributes to process relationships and behavioral anomalies on the endpoint. The following rules hunt for the "smoking gun" of this attack: a browser process spawning unexpected child processes or utilizing automation flags often associated with remote control.

SIGMA Rules

---
title: Potential msaRAT Browser Spawning Shell
id: 9a1b2c3d-4e5f-6789-0123-456789abcdef
status: experimental
description: Detects Chrome or Edge spawning command shells or PowerShell, a common indicator of browser-hijacking malware like msaRAT.
references:
 - https://attack.mitre.org/techniques/T1055/ (Process Injection)
author: Security Arsenal
date: 2026/04/22
tags:
 - attack.execution
 - attack.t1059.001
 - attack.t1059.003
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   ParentImage|endswith:
     - '\chrome.exe'
     - '\msedge.exe'
   Image|endswith:
     - '\cmd.exe'
     - '\powershell.exe'
     - '\pwsh.exe'
 condition: selection
falsepositives:
  - Legitimate debugging by developers (rare in production envs)
level: high
---
title: Browser Process with Remote Debugging Enabled
id: b2c3d4e5-6789-0123-4567-89abcdef012
status: experimental
description: Detects Chrome or Edge launched with remote debugging ports, which can be abused by malware like msaRAT for C2.
references:
 - https://attack.mitre.org/techniques/T1219/ (Remote Access Software)
author: Security Arsenal
date: 2026/04/22
tags:
 - attack.command_and_control
 - attack.t1071
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   Image|endswith:
     - '\chrome.exe'
     - '\msedge.exe'
   CommandLine|contains:
     - '--remote-debugging-port'
     - '--headless'
 condition: selection
falsepositives:
  - Developer automated testing workflows
level: medium

KQL (Microsoft Sentinel / Defender)

This query hunts for processes initiated by Chrome or Edge that are not typical browser sub-processes (e.g., utility processes, GPU processes). We focus on high-risk binaries like shells or script hosts.

DeviceProcessEvents
| where InitiatingProcessFileName in ("chrome.exe", "msedge.exe")
| where ProcessFileName in ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessFileName, ProcessCommandLine, FolderPath
| order by Timestamp desc

Velociraptor VQL

This artifact hunts for processes where the parent is a browser but the child is an administrative or scripting tool, indicative of misuse.

-- Hunt for browsers spawning suspicious child processes
SELECT Parent.Name AS ParentProcess, 
       Pid, 
       Name AS ChildProcess, 
       CommandLine, 
       Username
FROM pslist()
WHERE Parent.Name in ("chrome.exe", "msedge.exe")
  AND Name in ("cmd.exe", "powershell.exe", "wscript.exe", "mshta.exe")

Remediation Script (PowerShell)

Use this script on a suspected infected endpoint to identify and terminate instances where Chrome or Edge is actively spawning unauthorized shells. Note: Use caution in environments where developers perform browser-based testing.

# Identify and Kill Suspicious Browser-Spawned Processes
$SuspiciousParents = @('chrome.exe', 'msedge.exe')
$MaliciousChildren = @('cmd.exe', 'powershell.exe', 'pwsh.exe')

Get-WmiObject Win32_Process | Where-Object { 
    $SuspiciousParents -contains $_.ParentProcessName -and 
    $MaliciousChildren -contains $_.Name 
} | ForEach-Object {
    Write-Host "ALERT: Detected $($_.Name) (PID: $($_.ProcessId)) spawned by $($_.ParentProcessName). Terminating..." -ForegroundColor Red
    Stop-Process -Id $_.ProcessId -Force
}

Write-Host "Scan complete. Review browser extensions and recently downloaded files." -ForegroundColor Cyan

Remediation

1. Isolate the Host: Immediately disconnect the affected machine from the network to prevent further C2 communication or lateral movement.
2. Terminate Malicious Processes: Kill the browser instances and any spawned shells. If possible, terminate the parent msaRAT process (often masquerading as a system utility or located in AppData.
3. Audit Browser Extensions: msaRAT may persist via malicious browser extensions. Review installed extensions in Chrome/Edge settings and remove any unrecognized or recently added items.
4. Enable SSL Inspection: To defend against this class of attack long-term, ensure your network security infrastructure (proxy/NGFW) performs SSL/TLS decryption and inspection to detect C2 patterns inside the encrypted traffic.
5. Application Control: Implement AppLocker or WDAC policies to prevent chrome.exe and msedge.exe from spawning cmd.exe, powershell.exe, or other binaries.
6. User Education: Reinforce awareness regarding phishing emails, as the initial vector for msaRAT is typically a malicious attachment or link.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub