ModHeader Extension Takedown: Detecting and Removing the Dormant Data Collector

---
title: Potential Browser Extension Exfiltration via Non-Standard Ports
id: 8a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects browser processes establishing connections to non-standard ports, potentially indicating C2 beaconing or data exfiltration by a compromised extension.
references:
  - https://thehackernews.com/2026/07/google-and-microsoft-pull-modheader.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
    DestinationPort|not:
      - 80
      - 443
      - 8080
  filter_legit_traffic:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter_legit_traffic
falsepositives:
  - Internal web applications running on non-standard ports
  - Development environments
level: medium
---
title: Browser Process Spawning Shell - Extension Escape
id: 9b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects Chrome or Edge spawning a shell process, which can occur if a malicious extension exploits a browser vulnerability or uses a native messaging host for persistence.
references:
  - https://thehackernews.com/2026/07/google-and-microsoft-pull-modheader.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection_parent and selection_child
falsepositives:
  - User-initiated debugging or developer tools usage
level: high

let BrowserProcesses = dynamic(["chrome.exe", "msedge.exe"]);
DeviceNetworkEvents
| where InitiatingProcessFileName in~ BrowserProcesses
| where ActionType == "ConnectionAllowed"
| where RemoteUrl !contains "microsoft.com" and RemoteUrl !contains "google.com" and RemoteUrl !contains "google-analytics.com"
| summarize Count = count(), StartTime = min(Timestamp), EndTime = max(Timestamp) by DeviceId, InitiatingProcessAccountId, RemoteUrl, RemotePort
| where Count > 50 // Threshold for potential beaconing/collector activity within the query time window
| project DeviceId, Account = InitiatingProcessAccountId, RemoteUrl, RemotePort, Count, StartTime, EndTime
| order by Count desc

-- Hunt for ModHeader Extension Manifests
SELECT FullPath, Size, Mtime
FROM glob(globs="/**/Extensions/*/manifest.")
WHERE
  -- Read content and check for ModHeader
  read_file(filename=FullPath) =~ "ModHeader"
  -- Alternative: Check for specific known extension IDs if available
  OR FullPath =~ "idgpnmonknjnojddfkpgkljpfnnfcklj"  /* Example ID, update if specific 2026 ID is known */

# ModHeader Extension Removal Script
# Run as Administrator

$ErrorActionPreference = "SilentlyContinue"

# Define browser paths
$ChromeBasePath = "$env:LOCALAPPDATA\Google\Chrome\User Data"
$EdgeBasePath = "$env:SYSTEMDRIVE\Users"

Write-Host "[*] Starting scan for ModHeader extension..."

# Function to remove extension directories containing ModHeader manifest
function Remove-Extension {
    param (
        [string]$BasePath
    )

    if (-not (Test-Path $BasePath)) { return }

    # Search for manifest. files recursively
    Get-ChildItem -Path $BasePath -Recurse -Filter "manifest." -ErrorAction SilentlyContinue | ForEach-Object {
        $content = Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue
        if ($content -like "*ModHeader*") {
            $extPath = Split-Path $_.FullName -Parent
            Write-Host "[!] Found ModHeader extension at: $extPath" -ForegroundColor Yellow
            
            # Attempt to remove the directory
            try {
                Remove-Item -Path $extPath -Recurse -Force
                Write-Host "[+] Successfully removed: $extPath" -ForegroundColor Green
            }
            catch {
                Write-Host "[-] Failed to remove $extPath (File in use or permissions)." -ForegroundColor Red
            }
        }
    }
}

# Scan Chrome User Profiles
$UserProfiles = Get-ChildItem "$env:SYSTEMDRIVE\Users" -Directory
foreach ($Profile in $UserProfiles) {
    $ChromePath = Join-Path $Profile.FullName "AppData\Local\Google\Chrome\User Data"
    if (Test-Path $ChromePath) {
        Write-Host "[*] Scanning Chrome profile for $($Profile.Name)..."
        Remove-Extension -BasePath $ChromePath
    }
}

# Scan Edge User Profiles
foreach ($Profile in $UserProfiles) {
    $EdgePath = Join-Path $Profile.FullName "AppData\Local\Microsoft\Edge\User Data"
    if (Test-Path $EdgePath) {
        Write-Host "[*] Scanning Edge profile for $($Profile.Name)..."
        Remove-Extension -BasePath $EdgePath
    }
}

Write-Host "[*] Remediation scan complete. Please advise users to restart browsers."