Unit 42's latest entry in The XG Files series documents Falcon C2, a threat framework that turns the most ubiquitous application in any enterprise — the web browser — into a command-and-control channel. The campaign targets government organizations, delivering malicious scripts, rogue browser extensions, and a dedicated implant called Antino to establish persistent, low-noise access that blends into ordinary web traffic.
This matters because browser-based compromise defeats a large share of traditional perimeter and endpoint assumptions. There is no suspicious EXE to hash-block, no anomalous port to firewall, and no classic phishing payload to quarantine. The C2 traffic rides inside legitimate HTTPS sessions to attacker-controlled web infrastructure, and the persistence lives in the browser profile — a location most EDR policies and application whitelisting solutions treat as benign.
For defenders protecting government, defense-industrial, or any high-value enterprise network, Falcon C2 is a forcing function: if you are not inventorying browser extensions, monitoring browser child processes, and hunting for script interpreters spawned by browser processes, you have a blind spot this adversary is actively exploiting.
Technical Analysis
What Falcon C2 Is
Falcon C2 is a browser-centric threat framework rather than a single piece of malware. Per Unit 42's reporting, its delivery and execution model combines three components:
- Malicious scripts — script-based payloads executed in or alongside the browser context, reducing on-disk artifacts and complicating signature-based detection.
- Malicious browser extensions — extensions installed into the victim's browser that inherit broad, legitimate-looking permissions: read/change data on websites, access cookies and session tokens, and communicate outbound over HTTPS. Because extensions are supposed to talk to the web, their C2 traffic is structurally indistinguishable from normal browsing without behavioral analytics.
- The Antino implant — a dedicated implant component used for post-compromise operations, providing the operator with a more capable foothold on the endpoint beyond the browser sandbox.
Targeting and Victimology
The observed campaign concentrates on government organizations. This is consistent with espionage-motivated intrusion sets that prioritize stealth and persistence over speed — the same operational profile we see in long-dwell nation-state intrusions where the browser, email client, and identity tokens are the real objectives.
Why the Browser Is an Effective C2 Vehicle
From a defender's perspective, the attack chain breaks down like this:
- Initial access / installation: A malicious extension is installed (via social engineering, a trojanized installer, a compromised developer account, or sideloading), or a script is executed that stages the browser-resident component.
- Execution: The extension's background scripts or content scripts run with the browser's own privileges. Script-based components frequently leverage living-off-the-land interpreters (e.g.,
wscript.exe,cscript.exe,powershell.exe,mshta.exe) spawned as browser children — a high-fidelity detection point. - Command and control: Outbound requests ride over HTTPS to attacker infrastructure, often mimicking analytics, telemetry, or update endpoints. Beaconing periodicity and uniformity of request size are the differentiators.
- Persistence: Extensions persist across reboots by definition — they live in the browser profile (
Extensionsdirectory for Chrome/Edge, profileextensionsfor Firefox) and reload on every browser start. Registry-level ExtensionInstallForcelist abuse can force-install extensions on managed browsers without user consent. - Collection: Cookie stores, session tokens, saved credentials, and page content are accessible to a sufficiently privileged extension — enabling session hijacking that bypasses MFA entirely.
Exploitation Status
This is confirmed, active, in-the-wild activity against government targets documented by Unit 42. No CVE is associated with this campaign — it abuses legitimate browser extensibility features, which is precisely why patching alone cannot stop it. There is no vendor fix coming; the mitigation is architectural and behavioral.
Detection & Response
The highest-fidelity detection opportunities are: (1) browsers spawning script interpreters or shells, (2) non-standard or sideloaded extensions in browser profiles, (3) forced-install extension policies appearing in the registry, and (4) periodic HTTPS beaconing from browser processes to rare destinations.
SIGMA Rules
---
title: Browser Process Spawning Script Interpreter or Shell
id: 3f8a1c52-7b4e-4d91-a6c2-9e0f1b2d3c4a
status: experimental
description: Detects Chrome, Edge, or Firefox spawning script interpreters or command shells, consistent with Falcon C2 script-based components and browser-mediated execution.
references:
- https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/
- https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.execution
- attack.t1059
- attack.t1059.007
logsource:
category: process_creation
product: windows
detection:
selection_browser:
ParentImage|endswith:
- '\chrome.exe'
- '\msedge.exe'
- '\firefox.exe'
- '\brave.exe'
selection_child:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\cmd.exe'
- '\rundll32.exe'
condition: selection_browser and selection_child
falsepositives:
- Rare legitimate enterprise browser integrations and SSO tooling
- Developer workstations with browser-based debugging workflows
level: high
---
title: Browser Extension Force-Install via Registry Policy
id: 6c2d9e41-1a7f-4b38-b5d0-8f3c2a1e4d9b
status: experimental
description: Detects modification of browser ExtensionInstallForcelist or ExtensionSettings policies, a technique used to silently force-install malicious extensions such as those leveraged by Falcon C2.
references:
- https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/
- https://attack.mitre.org/techniques/T1176/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.persistence
- attack.t1176
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains:
- '\Policies\Google\Chrome\ExtensionInstallForcelist'
- '\Policies\Microsoft\Edge\ExtensionInstallForcelist'
- '\Policies\Microsoft\Edge\ExtensionSettings'
- '\Policies\Google\Chrome\ExtensionSettings'
- '\Policies\Mozilla\Firefox\Extensions'
condition: selection
falsepositives:
- Legitimate GPO-deployed enterprise extensions (baseline approved extension IDs and alert on deviations)
level: high
---
title: Execution from Browser Extension Profile Directory
id: 9b4e7a23-5d1c-4f86-a2b7-3c8d1e6f0a5c
status: experimental
description: Detects script or binary execution originating from browser extension directories, a strong indicator of a malicious or tampered extension component consistent with Falcon C2 activity.
references:
- https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/
- https://attack.mitre.org/techniques/T1176/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.execution
- attack.persistence
- attack.t1176
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- '\AppData\Local\Google\Chrome\User Data\Default\Extensions\'
- '\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\'
- '\AppData\Roaming\Mozilla\Firefox\Profiles\'
condition: selection
falsepositives:
- Extremely rare; legitimate extensions do not spawn OS processes
level: critical
KQL (Microsoft Sentinel / Defender)
// Hunt 1: Browser processes spawning script interpreters or shells (Falcon C2 execution pattern)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe")
| where FileName in~ ("powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "cmd.exe", "rundll32.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated desc;
// Hunt 2: Periodic HTTPS beaconing from browser processes to rare destinations
let browserProcs = dynamic(["chrome.exe", "msedge.exe", "firefox.exe"]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (browserProcs)
| where RemotePort in (443, 8443)
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
by DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
| where ConnectionCount > 100
| extend BeaconSpanMinutes = datetime_diff("minute", LastSeen, FirstSeen)
| where BeaconSpanMinutes > 120
// High-volume, long-duration browser connections to a single rare host warrant review
| join kind=leftanti (
DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| summarize FleetDevices = dcount(DeviceName) by RemoteUrl
| where FleetDevices > 10 // exclude destinations common across the fleet (update servers, CDN, SaaS)
) on RemoteUrl
| order by ConnectionCount desc;
// Hunt 3: Syslog-ingested hosts — process creation with browser extension paths (Linux/macOS via Syslog/CEF)
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("Default/Extensions", ".mozilla/firefox", "ExtensionInstallForcelist")
| project TimeGenerated, Computer, HostProcess, SyslogMessage
| order by TimeGenerated desc;
Velociraptor VQL
-- Falcon C2 Hunt: Enumerate installed browser extensions and flag non-standard/sideloaded entries
-- plus browser processes with suspicious child processes
-- Part A: Inventory Chrome/Edge extension manifests across user profiles
SELECT FullPath AS ManifestPath,
read_file(filename=FullPath) AS ManifestContent,
mtime(filename=FullPath) AS ManifestMTime
FROM glob(globs='C:/Users/*/AppData/Local/*/Chrome/User Data/*/Extensions/*/*/manifest.json')
WHERE ManifestContent =~ '"update_url"'
AND NOT ManifestContent =~ 'clients2.google.com|edge.microsoft.com'
-- Extensions not pointing at official stores may be sideloaded or attacker-controlled
-- Part B: Browser processes with script-interpreter or shell children
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'wscript|cscript|mshta|powershell|rundll32'
AND Ppid IN (
SELECT Pid FROM pslist()
WHERE Name =~ 'chrome|msedge|firefox'
)
-- Part C: Browser processes holding long-lived outbound TLS connections
SELECT Pid, Name, RemoteAddr, RemotePort, State
FROM netstat()
WHERE Name =~ 'chrome|msedge|firefox'
AND RemotePort IN (443, 8443)
AND State =~ 'ESTABLISHED'
Remediation / Hardening Script (PowerShell)
# Falcon C2 Browser Extension Audit & Hardening
# Run elevated. Audits installed extensions, flags non-store extensions, and applies extension allowlisting policy.
$report = @()
$browserPaths = @(
"$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions",
"$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Extensions"
)
# Step 1: Inventory all installed extensions across browser profiles
foreach ($base in $browserPaths) {
if (Test-Path $base) {
Get-ChildItem -Path $base -Directory -ErrorAction SilentlyContinue | ForEach-Object {
$extId = $_.Name
$manifest = Get-ChildItem -Path $_.FullName -Recurse -Filter "manifest.json" -ErrorAction SilentlyContinue | Select-Object -First 1
if ($manifest) {
$m = Get-Content $manifest.FullName -Raw | ConvertFrom-Json
$updateUrl = $m.update_url
$isStoreSigned = $updateUrl -match "clients2.google.com|edge.microsoft.com"
$report += [PSCustomObject]@{
ExtensionId = $extId
Name = $m.name
Version = $m.version
Browser = ($base -split "\\")[3]
StoreSigned = $isStoreSigned
ManifestPath = $manifest.FullName
}
}
}
}
}
# Step 2: Flag extensions NOT from official stores (sideloaded / potentially malicious)
Write-Host "=== Non-store extensions (investigate these first) ===" -ForegroundColor Yellow
$report | Where-Object { -not $_.StoreSigned } | Format-Table -AutoSize
$report | Export-Csv -Path "C:\Temp\ExtensionAudit_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
# Step 3: Check for suspicious ExtensionInstallForcelist entries (persistence indicator)
$policyKeys = @(
"HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist",
"HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist",
"HKCU:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist"
)
foreach ($key in $policyKeys) {
if (Test-Path $key) {
Write-Host "[!] Force-install policy found at $key — verify each entry against approved list:" -ForegroundColor Red
Get-ItemProperty $key | Format-List
}
}
# Step 4: Harden — block all extensions except an explicit allowlist (Chrome example)
# Populate ExtensionInstallAllowlist with your approved extension IDs before enabling the blocklist wildcard.
$chromePolicy = "HKLM:\SOFTWARE\Policies\Google\Chrome"
New-Item -Path "$chromePolicy\ExtensionInstallBlocklist" -Force | Out-Null
New-ItemProperty -Path "$chromePolicy\ExtensionInstallBlocklist" -Name "1" -Value "*" -PropertyType String -Force | Out-Null
# Example: allowlist an approved extension
# New-Item -Path "$chromePolicy\ExtensionInstallAllowlist" -Force | Out-Null
# New-ItemProperty -Path "$chromePolicy\ExtensionInstallAllowlist" -Name "1" -Value "<approved_extension_id>" -PropertyType String -Force
Write-Host "[+] Audit complete. Review the CSV, validate force-install entries, and populate the allowlist before enforcing the wildcard blocklist." -ForegroundColor Green
Remediation
Because Falcon C2 abuses legitimate browser functionality rather than a patchable vulnerability, remediation is architectural. Prioritize the following:
- Immediate triage of installed extensions. Run the audit script above (or your EDR equivalent) across the fleet. Any extension not signed by the official Chrome Web Store or Edge Add-ons pipeline — or whose
update_urlpoints to third-party infrastructure — should be treated as suspect, removed, and its extension ID blocked. - Enforce extension allowlisting via policy. Use Chrome
ExtensionInstallAllowlist/ExtensionInstallBlocklistand EdgeExtensionSettingspolicies (GPO, Intune, or Chrome Enterprise Cloud) so users cannot install arbitrary extensions. This is the single highest-value control against this framework. - Hunt for Antino implant artifacts. Review Unit 42's published indicators from the original advisory and sweep endpoints and network telemetry for matching hashes, domains, and file paths. Subscribe to Unit 42's ATOM feed for indicator updates as the campaign evolves.
- Alert on browser-spawned child processes. Deploy the Sigma rules above. A browser spawning PowerShell, WScript, or MSHTA is a near-zero-false-positive signal in most enterprises.
- Protect session tokens. Because extension-based theft of cookies defeats MFA, shorten session lifetimes, enable token binding/continuous access evaluation where available, and monitor IdP logs for session reuse from anomalous geographies or ASNs.
- Network-layer detection. Baseline browser egress destinations per host. Beaconing to rare, long-duration TLS endpoints from browser processes — especially outside SaaS/CDN ranges — is a strong hunt hypothesis (see KQL Hunt 2).
- Restrict script interpreters via WDAC/AppLocker for standard users, and enable PowerShell Script Block Logging and AMSI integration to capture script-based components even when they execute in-memory.
- For government and high-value networks: assume targeted persistence. If an extension-based compromise is confirmed, reimage affected endpoints, revoke all sessions and tokens for impacted users, and rotate credentials — extension-resident implants frequently outlive a simple extension removal.
Conclusion
Falcon C2 is a reminder that the browser is now a full execution environment — with its own persistence mechanism (extensions), its own network channel (HTTPS), and its own credential store (cookies and tokens) — and most security programs govern it far less rigorously than the OS beneath it. The defenders who close this gap fastest are the ones who treat extension inventory, browser child-process telemetry, and egress beacon analysis as first-class SOC disciplines rather than edge cases. Unit 42's reporting gives you the indicators; the detections and hardening steps above give you the coverage. Deploy them now — the targeting of government networks means this framework is operational, not theoretical.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.