Hotel Wi-Fi Espionage: Detecting Fake Update Attacks and Surveillance Malware

---
title: Fake Update Execution via Browser
id: 8a4d2e10-9c3f-4a5b-8e1d-2f3c4b5a6d7e
status: experimental
description: Detects suspicious execution of update binaries (msiexec, powershell) spawned directly by a browser process, indicative of a fake update attack.
references:
 - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/08/15
tags:
 - attack.execution
 - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
    Image|endswith:
      - '\msiexec.exe'
      - '\powershell.exe'
      - '\cmd.exe'
  filter_legitimate:
    # Filter out specific legitimate software vendors if necessary, but be cautious
    CommandLine|contains:
      - 'Software\Microsoft\Windows\CurrentVersion\Run'
  condition: selection and not filter_legitimate
falsepositives:
  - Legitimate web-based software installers (rare for corporate devices)
level: high
---
title: Suspicious Proxy Settings (WPAD Manipulation)
id: 9b5e3f21-0d4g-5h6i-7j8k-9l0m1n2o3p4q
status: experimental
description: Detects changes to proxy settings often associated with MitM attacks on public Wi-Fi attempting to force traffic through a malicious proxy.
references:
 - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/15
tags:
 - attack.defense_evasion
 - attack.t1112
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - 'Software\Microsoft\Windows\CurrentVersion\Internet Settings'
      - 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings'
    Details|contains:
      - 'http://'
      - '127.0.0.1'
  condition: selection
falsepositives:
  - Legitimate corporate proxy configuration changes via GPO
level: medium

// Hunt for update mechanisms spawned by browsers
let BrowserProcesses = dynamic(["chrome.exe", "msedge.exe", "firefox.exe", "brave.exe"]);
let InstallerProcesses = dynamic(["msiexec.exe", "powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe"]);
DeviceProcessEvents
| where InitiatingProcessFileName in~ (BrowserProcesses)
| where FileName in~ (InstallerProcesses)
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, CommandLine, FileName, FolderPath
| order by Timestamp desc

-- Hunt for unsigned binaries recently spawned by browsers
SELECT
  Pid,
  Name,
  CommandLine,
  Exe,
  Username,
  CreateTime,
  SigState,
  SigPublisher
FROM pslist()
WHERE
  -- Filter for recent processes (last 10 minutes)
  CreateTime > now() - 10 * 60
  AND Name IN ('msiexec.exe', 'powershell.exe', 'cmd.exe')
  AND Parent.ProcessName =~ '(chrome|msedge|firefox)'
  -- Check for unsigned or suspiciously signed binaries
  AND (SigState != 'Trusted' OR SigState IS MISSING)

# Function to reset proxy settings to direct (Mitigation for WPAD hijacking)
function Reset-NetworkProxy {
    Write-Host "Checking for malicious proxy configurations..."
    $regPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
    
    $proxyEnable = Get-ItemProperty -Path $regPath -Name "ProxyEnable" -ErrorAction SilentlyContinue
    $proxyServer = Get-ItemProperty -Path $regPath -Name "ProxyServer" -ErrorAction SilentlyContinue

    if ($proxyEnable.ProxyEnable -eq 1) {
        Write-Host "WARNING: Proxy is enabled. Server: $($proxyServer.ProxyServer)" -ForegroundColor Yellow
        # Disable Proxy
        Set-ItemProperty -Path $regPath -Name "ProxyEnable" -Value 0
        Set-ItemProperty -Path $regPath -Name "ProxyServer" -Value ""
        Write-Host "Proxy disabled." -ForegroundColor Green
    } else {
        Write-Host "No manual proxy detected."
    }
}

# Function to check for suspicious persistence in Run keys
function Check-SuspiciousPersistence {
    Write-Host "Checking Run keys for unsigned binaries..."
    $paths = @(
        "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
        "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
    )
    
    foreach ($path in $paths) {
        if (Test-Path $path) {
            Get-Item -Path $path | Select-Object -ExpandProperty Property | ForEach-Object {
                $propName = $_
                $propValue = (Get-ItemProperty -Path $path -Name $propName).$propName
                if ($propValue -match ".exe") {
                    $exePath = $propValue -replace '".*?"' | Select-String -Pattern "([a-zA-Z]:\\.+\.exe)" | ForEach-Object { $_.Matches.Value }
                    if ($exePath) {
                        if (Test-Path $exePath) {
                            $sig = Get-AuthenticodeSignature -FilePath $exePath
                            if ($sig.Status -ne 'Valid') {
                                Write-Host "ALERT: Unsigned persistence found in $path : $propName pointing to $exePath" -ForegroundColor Red
                            }
                        }
                    }
                }
            }
        }
    }
}

Reset-NetworkProxy
Check-SuspiciousPersistence