Google Password Manager Passkey Hijacking: Detect and Defend Against Pass-ta-key Attacks

---
title: Google Password Manager Database Access by Non-Chrome Process
id: 8a4f2c1e-7d3b-4a9e-8f1c-3b2d4e5f6a7b
status: experimental
description: Detects non-browser processes accessing Chrome's Google Password Manager SQLite database files, potentially indicating passkey extraction attempts.
references:
  - https://attack.mitre.org/techniques/T1003/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.credential_access
  - attack.t1003
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\Google\Chrome\User Data\Default\Web Data'
      - '\Google\Chrome\User Data\Default\Login Data'
      - '\Google\Chrome\User Data\Local State'
  filter:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
  condition: selection and not filter
falsepositives:
  - Legitimate backup software
  - Security scanning tools
  - User-initiated data migration
level: high
---
title: Suspicious Chrome Spawn with Authentication Flags
id: 9b5g3d2f-8e4c-5b0f-9g2d-4c3e5f6a7b8c
status: experimental
description: Detects Chrome processes spawned with unusual command-line arguments related to WebAuthn or password manager access, potentially indicating Pass-ta-key exploitation.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\chrome.exe'
    CommandLine|contains:
      - '--auth-server-whitelist'
      - '--password-store'
      - '--webauthn'
  filter_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\explorer.exe'
      - '\cmd.exe'
      - '\powershell.exe'
  condition: selection and not filter_parent
falsepositives:
  - Administrative automation
  - Legitimate testing
level: medium
---
title: Potential Passkey Master Key Extraction via Process Memory Access
id: 0c6h4e3g-9f5d-6c1g-0h3e-5d4f6g7h8i9j
status: experimental
description: Detects processes attempting to access Chrome process memory with API calls often used for credential extraction, potentially targeting Golden Pass-ta-key master key material.
references:
  - https://attack.mitre.org/techniques/T1006/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.credential_access
  - attack.t1006
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: '\chrome.exe'
    GrantedAccess|contains:
      - '0x1010'
      - '0x143A'
      - '0x1F0FFF'
    CallTrace|contains:
      - 'MiniDumpWriteDump'
      - 'ReadProcessMemory'
  filter_legitimate:
    SourceImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\ WerFault.exe'
      - '\procexp.exe'
      - '\procexp64.exe'
  condition: selection and not filter_legitimate
falsepositives:
  - Browser crash debugging
  - System troubleshooting tools
level: high

// Hunt for Pass-ta-key attack indicators - suspicious Chrome component access
let SuspiciousAccess = materialize (
    DeviceFileEvents
    | where Timestamp > ago(7d)
    | where FolderPath has @"Google\Chrome\User Data" 
    | where FileName in ("Web Data", "Login Data", "Local State", "Network")
    | where InitiatingProcessFileName !in ("chrome.exe", "msedge.exe", "brave.exe", "explorer.exe")
    | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessId, 
              InitiatingProcessAccountName, ActionType, FolderPath, FileName
);
let SuspiciousProcessCreation = materialize (
    DeviceProcessEvents
    | where Timestamp > ago(7d)
    | where FileName == "chrome.exe"
    | where ProcessCommandLine has_any ("--password-store", "--auth-server", "--webauthn")
    | where InitiatingProcessFileName !in ("chrome.exe", "explorer.exe", "cmd.exe", "powershell.exe")
    | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, 
              ProcessCommandLine, AccountName
);
let SuspiciousMemoryAccess = materialize (
    DeviceProcessEvents
    | where Timestamp > ago(7d)
    | where TargetProcessFileName == "chrome.exe"
    | where InitiatingProcessFileName !in ("chrome.exe", "msedge.exe", "WerFault.exe", "procexp64.exe")
    | where ProcessCommandLine has_any ("MiniDump", "ReadProcessMemory", "procdump")
    | project Timestamp, DeviceName, InitiatingProcessFileName, AccountName, ProcessCommandLine
);
union SuspiciousAccess, SuspiciousProcessCreation, SuspiciousMemoryAccess
| summarize count() by DeviceName, bin(Timestamp, 1h)
| where count_ > 0
| order by Timestamp desc

-- Hunt for Pass-ta-key attack artifacts: Chrome credential store access
-- and suspicious process relationships

SELECT 
    timestamp(epoch=Sys.EventTime) AS EventTime,
    Sys.Hostname AS Hostname,
    Process.Pid,
    Process.Ppid,
    Process.Name AS ProcessName,
    Process.Username,
    Process.CommandLine,
    Process.Exe
FROM pslist()
WHERE 
    -- Identify non-browser processes that might be targeting Chrome
    Process.Name =~ 'chrome.exe' 
    AND Process.Pid IN (
        SELECT ParentPid 
        FROM pslist() 
        WHERE Name !~ 'chrome.exe' 
        AND Name !~ 'explorer.exe'
    )
    OR
    -- Look for processes accessing Chrome profile directories
    Process.CommandLine =~ 'Google.*Chrome.*User Data'
    OR
    -- Identify potential memory access tools
    Process.Name =~ 'procdump'
    OR Process.Name =~ 'dumpit'
    OR Process.Exe =~ '%TEMP%\\.*.exe'

-- Also scan for Chrome password manager database files
UNION

SELECT 
    timestamp(epoch=Mtime) AS EventTime,
    Sys.Hostname AS Hostname,
    FullPath AS FilePath,
    Size,
    Mode
FROM glob(globs="/Users/*/AppData/Local/Google/Chrome/User Data/**/{Web Data,Login Data,Local State}")
WHERE Mode =~ 'r'

-- Check for suspicious handle access to Chrome processes
UNION

SELECT 
    timestamp(epoch=Sys.EventTime) AS EventTime,
    Sys.Hostname AS Hostname,
    Handle.Pid,
    Handle.Name AS HandleName,
    Handle.Type,
    Process.Name AS HoldingProcess
FROM handles()
WHERE 
    Handle.Type =~ "File"
    AND Handle.Name =~ "Chrome"
    AND Process.Name !~ "chrome.exe"

# Google Password Manager Pass-ta-key Attack Remediation and Hardening Script
# Version: 1.0
# Date: 2026-08-15

#Requires -RunAsAdministrator

Write-Host "=== Google Password Manager Security Assessment and Hardening ===" -ForegroundColor Cyan

# Check Chrome version
Write-Host "\n[1] Checking Chrome version..." -ForegroundColor Yellow
try {
    $chromePath = "${env:ProgramFiles}\Google\Chrome\Application\chrome.exe"
    if (Test-Path $chromePath) {
        $chromeVersion = (Get-Item $chromePath).VersionInfo.FileVersion
        Write-Host "Chrome version installed: $chromeVersion" -ForegroundColor Green
        
        # Check for recent versions (post-2026 Q2 recommended for passkey hardening)
        $versionParts = $chromeVersion.Split('.')
        $majorVersion = [int]$versionParts[0]
        if ($majorVersion -ge 130) {
            Write-Host "PASS: Chrome version appears recent enough for current passkey security patches." -ForegroundColor Green
        } else {
            Write-Host "WARNING: Chrome version may be outdated. Update to latest version for passkey protections." -ForegroundColor Red
        }
    } else {
        Write-Host "Chrome not found in default path." -ForegroundColor Gray
    }
} catch {
    Write-Host "ERROR: Could not determine Chrome version: $_" -ForegroundColor Red
}

# Check Chrome security flags
Write-Host "\n[2] Checking Chrome security registry settings..." -ForegroundColor Yellow
$chromeRegPath = "HKLM:\SOFTWARE\Policies\Google\Chrome"
if (Test-Path $chromeRegPath) {
    $passwordManagerEnabled = (Get-ItemProperty $chromeRegPath -ErrorAction SilentlyContinue).PasswordManagerEnabled
    if ($passwordEnabled -eq 0) {
        Write-Host "INFO: Password Manager disabled via policy." -ForegroundColor Cyan
    } else {
        Write-Host "INFO: Password Manager enabled." -ForegroundColor Cyan
    }
} else {
    Write-Host "INFO: No Chrome group policies found." -ForegroundColor Gray
}

# Audit Google Password Manager sync settings
Write-Host "\n[3] Auditing Google Password Manager configuration recommendations..." -ForegroundColor Yellow
Write-Host "RECOMMENDATION: Review Google Account security settings at https://myaccount.google.com/security" -ForegroundColor Cyan
Write-Host "  - Enable 2FA with hardware security keys where possible" -ForegroundColor Cyan
Write-Host "  - Review 'Signing in to other sites' permissions" -ForegroundColor Cyan
Write-Host "  - Check for unfamiliar passkeys registered to your account" -ForegroundColor Cyan

# Check for suspicious processes accessing Chrome user data
Write-Host "\n[4] Checking for processes accessing Chrome profile directories..." -ForegroundColor Yellow
$chromeUserDataPath = "$env:LOCALAPPDATA\Google\Chrome\User Data"
if (Test-Path $chromeUserDataPath) {
    $openHandles = Get-Process | ForEach-Object {
        $process = $_
        try {
            $modules = $process.Modules | Where-Object { $_.FileName -like "*$chromeUserDataPath*" }
            if ($modules) {
                [PSCustomObject]@{
                    ProcessName = $process.ProcessName
                    ProcessId = $process.Id
                    Path = $modules.FileName
                }
            }
        } catch {
            # Ignore processes we can't inspect
        }
    }
    
    if ($openHandles) {
        Write-Host "WARNING: The following processes have Chrome user data loaded:" -ForegroundColor Red
        $openHandles | Format-Table -AutoSize
    } else {
        Write-Host "PASS: No unusual processes detected with Chrome user data access." -ForegroundColor Green
    }
}

# Provide hardening guidance
Write-Host "\n[5] Hardening Recommendations..." -ForegroundColor Yellow
Write-Host @"

IMMEDIATE ACTIONS:

Write-Host "\n=== Assessment Complete ===" -ForegroundColor Cyan
Write-Host "For incident response assistance, contact Security Arsenal IR team." -ForegroundColor Gray