Fast16 Malware Campaign: Detecting XChat Extension Delivery & Remote Tool Abuse

---
title: Potential Malicious Browser Extension Spawning Shell
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects browser processes (Chrome, Edge, Firefox) spawning cmd.exe or powershell.exe, a common TTP for malicious extensions like XChat.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1176/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Legitimate developer debugging or browser-based terminal utilities
level: high
---
title: Fast16 - Silent Installation of Remote Access Tools
id: b1c2d3e4-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects command-line parameters indicative of silent or unattended installation of common remote management tools often abused in Fake Help Desk scams.
references:
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\AnyDesk.exe'
      - '\scclient.exe'
      - '\TeamViewer.exe'
      - '\ScreenConnect.exe'
      - '\ConnectWiseControl.Client.exe'
  selection_cli:
    CommandLine|contains:
      - '--install'
      - '--silent'
      - '/install'
      - '/silent'
      - '--unattended'
  condition: all of selection_*
falsepositives:
  - Authorized IT management software deployment via RMM tools or SCCM
level: medium


**KQL (Microsoft Sentinel / Defender)**

// Hunt for Fast16 activity: Browser spawning shells and suspicious RMM installs
let SuspiciousParents = dynamic(['chrome.exe', 'msedge.exe', 'firefox.exe']);
let SuspiciousChildren = dynamic(['cmd.exe', 'powershell.exe', 'pwsh.exe']);
let RemoteTools = dynamic(['AnyDesk.exe', 'scclient.exe', 'TeamViewer.exe', 'ScreenConnect.exe']);
// Join Process Creation events with Network events to find C2 patterns
DeviceProcessEvents
| where ((FileName in~ SuspiciousChildren and InitiatingProcessFileName in~ SuspiciousParents) or 
        (FileName in~ RemoteTools and CommandLine has_any('--install', '/silent', '--unattended')))
| extend Timestamp = TimeGenerated, DeviceName = DeviceName, Account = AccountName
| project Timestamp, DeviceName, Account, InitiatingProcessFileName, FileName, CommandLine, FolderPath
| order by Timestamp desc


**Velociraptor VQL**

-- Hunt for XChat extension or malicious browser artifacts and process chains
SELECT 
  Pid, 
  Name, 
  Parent.Pid AS ParentPid, 
  Parent.Name AS ParentName,
  CommandLine, 
  Exe
FROM pslist()
WHERE 
  -- Detect browser spawning shells
  (Name IN ('cmd.exe', 'powershell.exe', 'pwsh.exe') AND Parent.Name IN ('chrome.exe', 'msedge.exe', 'firefox.exe'))
  OR
  -- Detect RMM tools with suspicious args
  (Name =~ 'AnyDesk.exe' OR Name =~ 'scclient.exe' OR Name =~ 'TeamViewer.exe') AND CommandLine =~ '(?i)--install|/silent|unattended'


**Remediation Script (PowerShell)**

# Fast16 Response Script: Remove Malicious Extensions and Audit RMM Tools
# Requires Administrator Privileges

Write-Host "[+] Starting Fast16 Remediation Checks..." -ForegroundColor Cyan

# 1. Check for known malicious XChat extension IDs (Placeholder IDs based on threat intel)
$MaliciousExtensions = @("abcdefghijklmnop", "xchat-loader-id")
$ChromePaths = @("$env:LOCALAPPDATA\Google\Chrome\User Data", "$env:APPDATA\Google\Chrome\User Data")

foreach ($Path in $ChromePaths) {
    if (Test-Path $Path) {
        Write-Host "[*] Scanning Chrome Profiles in $Path" -ForegroundColor Yellow
        Get-ChildItem -Path $Path -Directory -Filter "Default*" | ForEach-Object {
            $ExtPath = Join-Path -Path $_.FullName -ChildPath "Extensions"
            if (Test-Path $ExtPath) {
                $Found = Get-ChildItem -Path $ExtPath -Directory | Where-Object { $MaliciousExtensions -contains $_.Name }
                if ($Found) {
                    Write-Host "[!] ALERT: Malicious Extension found at $($Found.FullName). Removing..." -ForegroundColor Red
                    # Remove-Item -Path $Found.FullName -Recurse -Force -ErrorAction SilentlyContinue
                }
            }
        }
    }
}

# 2. Audit for recently installed RMM tools common in Fake Help Desk scams
$RMMProcesses = @("AnyDesk", "TeamViewer", "scclient", "ConnectWiseControl")
$RunningRMM = Get-Process | Where-Object { $RMMProcesses -contains $_.ProcessName }

if ($RunningRMM) {
    Write-Host "[!] WARNING: Remote Access Tools detected running. Verify authorization:" -ForegroundColor Red
    $RunningRMM | Format-Table Id, ProcessName, Path, StartTime -AutoSize
} else {
    Write-Host "[+] No common unauthorized RMM tools detected." -ForegroundColor Green
}

Write-Host "[+] Remediation Script Complete." -ForegroundColor Cyan