PEEP Post-Compromise Toolkit: Detecting and Removing Malicious Chromium Extensions Injected via Forged Secure Preferences

---
title: Chromium Browser Spawning Command Interpreter
description: Detects chrome.exe or msedge.exe spawning command shells or script hosts, consistent with PEEP-style extension-brokered host command execution.
id: 3f8a1b2c-7d4e-4f1a-9b2c-5e6d7a8b9c01
status: experimental
references:
  - https://attack.mitre.org/techniques/T1176/
  - https://thehackernews.com/2026/09/peep-turns-chrome-and-edge-into-post.html
author: Security Arsenal
date: 2026/09/22
tags:
  - attack.persistence
  - attack.execution
  - attack.t1176
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare enterprise browser plugins invoking native helpers; investigate rather than auto-exclude
level: high
---
title: Secure Preferences Modified by Non-Browser Process
description: Detects writes to Chromium Secure Preferences by processes other than the browser itself, consistent with PEEP's forged-preference injection technique.
id: 9c2d4e6f-1a3b-4c5d-8e7f-2a4b6c8d0e12
status: experimental
references:
  - https://attack.mitre.org/techniques/T1176/
  - https://thehackernews.com/2026/09/peep-turns-chrome-and-edge-into-post.html
author: Security Arsenal
date: 2026/09/22
tags:
  - attack.persistence
  - attack.defense_evasion
  - attack.t1176
logsource:
  category: file_change
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - '\Google\Chrome\User Data\Default\Secure Preferences'
      - '\Microsoft\Edge\User Data\Default\Secure Preferences'
    TargetFilename|contains:
      - '\User Data\Profile'
  filter_browser:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
  condition: selection and not filter_browser
falsepositives:
  - Enterprise backup or sync agents touching profile files; scope exclusions by signed binary hash
level: high
---
title: Chromium Extension Sideloading via Command Line
description: Detects Chrome or Edge launched with flags that load unpacked or non-store extensions, a technique used to stage or test injected extensions like PEEP's payload.
id: 5b7c9d1e-3f5a-4b6c-9d8e-4f6a8b0c2e45
status: experimental
references:
  - https://attack.mitre.org/techniques/T1176/
author: Security Arsenal
date: 2026/09/22
tags:
  - attack.persistence
  - attack.t1176
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
    CommandLine|contains:
      - '--load-extension'
      - '--disable-extensions-except'
      - '--whitelisted-extension-id'
  condition: selection
falsepositives:
  - Legitimate extension developers and QA teams; restrict via group policy rather than detection tuning
level: medium

// Hunt 1: Browsers spawning command interpreters — PEEP execution channel
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe",
                      "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName,
          InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| sort by TimeGenerated desc
;
// Hunt 2: Non-browser processes writing Secure Preferences — injection artifact
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FolderPath has "Secure Preferences"
| where FolderPath has_any ("Google\\Chrome\\User Data", "Microsoft\\Edge\\User Data")
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "msedgewebview2.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName,
          InitiatingProcessCommandLine, FolderPath, ActionType, SHA256
| sort by TimeGenerated desc

-- PEEP hunt: enumerate sideloaded Chromium extensions and profile injection artifacts
-- Flags extensions written to profile directories and Secure Preferences markers
-- indicating non-Web-Store installs (from_webstore=false)

LET ext_manifests = SELECT FullPath, Mtime, Size
FROM glob(globs="C:/Users/*/AppData/Local/*/User Data/*/Extensions/*/*/manifest.json")
WHERE NOT IsDir

LET secure_prefs = SELECT FullPath, Mtime,
       read_file(filename=FullPath) AS Content
FROM glob(globs="C:/Users/*/AppData/Local/*/User Data/*/Secure Preferences")
WHERE Content =~ '"from_webstore": ?false'

SELECT "Extension Directory" AS Artifact, FullPath, Mtime, Size, "" AS SideloadIndicator
FROM ext_manifests
UNION ALL
SELECT "Secure Preferences" AS Artifact, FullPath, Mtime, 0 AS Size,
       "contains from_webstore=false entries" AS SideloadIndicator
FROM secure_prefs
ORDER BY Mtime DESC

#Requires -RunAsAdministrator
# PEEP-Style Malicious Extension Detection and Remediation
param([switch]$Remediate)

$report = @()
$profileRoots = @(
    "$env:LOCALAPPDATA\Google\Chrome\User Data",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data"
)

foreach ($root in $profileRoots) {
    if (-not (Test-Path $root)) { continue }
    $browser = if ($root -match 'Chrome') { 'Chrome' } else { 'Edge' }
    Get-ChildItem $root -Directory |
        Where-Object { $_.Name -eq 'Default' -or $_.Name -like 'Profile *' } |
        ForEach-Object {
            $spPath = Join-Path $_.FullName 'Secure Preferences'
            if (-not (Test-Path $spPath)) { return }
            $sp = Get-Content $spPath -Raw | ConvertFrom-Json
            $extSettings = $sp.extensions.settings
            if (-not $extSettings) { return }
            foreach ($prop in $extSettings.PSObject.Properties) {
                $ext = $prop.Value
                $sideloaded = ($ext.from_webstore -eq $false)
                if ($sideloaded) {
                    $entry = [PSCustomObject]@{
                        Browser      = $browser
                        Profile      = $_.Name
                        ExtensionId  = $prop.Name
                        DisplayName  = $ext.manifest.name
                        InstallPath  = $ext.path
                        FromWebStore = $ext.from_webstore
                        State        = $ext.state
                    }
                    $report += $entry
                    if ($Remediate) {
                        $extDir = Join-Path $_.FullName ("Extensions\" + $prop.Name)
                        if (Test-Path $extDir) {
                            Copy-Item $spPath "$spPath.bak_$(Get-Date -Format 'yyyyMMddHHmmss')" -Force
                            Rename-Item $extDir "$extDir.quarantined" -Force
                            Write-Host "[QUARANTINED] $browser/$($_.Name): $($prop.Name)" -ForegroundColor Yellow
                        }
                    }
                }
            }
        }
}

$report | Format-Table -AutoSize
if (-not $Remediate) { Write-Host "Re-run with -Remediate to quarantine flagged extensions." }

# Hardening: block non-store extension installs and disable developer mode (machine-wide)
$chromePolicy = 'HKLM:\SOFTWARE\Policies\Google\Chrome'
$edgePolicy   = 'HKLM:\SOFTWARE\Policies\Microsoft\Edge'
foreach ($policyRoot in @($chromePolicy, $edgePolicy)) {
    New-Item $policyRoot -Force | Out-Null
    New-Item "$policyRoot\ExtensionInstallBlocklist" -Force | Out-Null
    # Block all extensions not explicitly allowlisted via ExtensionInstallAllowlist
    New-ItemProperty "$policyRoot\ExtensionInstallBlocklist" -Name '1' -Value '*' -PropertyType String -Force | Out-Null
    # Disable developer mode / sideload UI
    New-ItemProperty $policyRoot -Name 'DeveloperToolsAvailability' -Value 2 -PropertyType DWord -Force | Out-Null
    # Prevent --load-extension style developer workflows
    New-ItemProperty $policyRoot -Name 'ExtensionInstallSources' -Value 'https://clients2.google.com/service/update2/crx' -PropertyType String -Force | Out-Null
}
Write-Host "[HARDENED] Extension install blocklist and developer mode restrictions applied. Reboot browsers to enforce." -ForegroundColor Green