Polymarket Supply-Chain Breach: $2.7M Stolen via Hijacked DebugBear Script — Detection & Response Guide

---
title: Suspicious Browser Child Process Execution
id: 8f4c2a91-3b7e-4d5a-9c1f-2e8a6b4d7f3a
status: experimental
description: Detects browsers spawning unexpected child processes, potentially indicating malicious JavaScript execution attempting to escape browser sandbox or execute system commands.
references:
  - https://attack.mitre.org/techniques/T1189/
  - https://attack.mitre.org/techniques/T1059/007/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1189
  - attack.execution
  - attack.t1059.007
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\brave.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Browser extensions with system integration
  - Enterprise browser management tools
level: high
---
title: Unusual Network Connections from Browser Process
id: 6d3e8b12-9f4a-4c7d-8e2b-5a9c3f7d1e6b
status: experimental
description: Detects browsers establishing connections to suspicious or newly registered domains, potentially indicating data exfiltration or C2 communication from compromised third-party scripts.
references:
  - https://attack.mitre.org/techniques/T1071/001/
  - https://attack.mitre.org/techniques/T1102/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection_browser:
    Image|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
  selection_suspicious:
    DestinationHostname|contains:
      - 'webhook.site'
      - 'ngrok.io'
      - 'requestbin'
      - 'pipedream'
      - 'pastebin.com/api'
  condition: selection_browser and selection_suspicious
falsepositives:
  - Developer testing tools
  - Legitimate webhook integrations
level: medium
---
title: Clipboard Access from Browser Process
id: 4a7f9e2c-8d1b-4f6a-9c3e-7b2d5f8a4e1c
status: experimental
description: Detects browsers accessing clipboard functionality, which may indicate credential or cryptocurrency address theft by malicious scripts.
references:
  - https://attack.mitre.org/techniques/T1115/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1115
logsource:
  category: process_access
  product: windows
detection:
  selection:
    SourceImage|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
    TargetImage|contains: 'clip'
    GrantedAccess|contains: '0x1'
falsepositives:
  - Legitimate copy-paste functionality
  - Password managers
level: low

// Hunt for suspicious browser child process execution
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("chrome.exe", "firefox.exe", "msedge.exe", "brave.exe")
| where FileName in~ ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName
| order by TimeGenerated desc

// Hunt for browsers connecting to suspicious domains commonly used for exfiltration
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("chrome.exe", "firefox.exe", "msedge.exe")
| where RemoteUrl has_any ("webhook.site", "ngrok.io", "requestbin", "pipedream", "burpcollaborator")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
| order by TimeGenerated desc

// Hunt for unusual JavaScript file downloads or modifications
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FileName endswith ".js"
| where FolderPath has_any ("Downloads", "Temp", "AppData")
| where InitiatingProcessFileName in~ ("chrome.exe", "firefox.exe", "msedge.exe")
| extend FileHash = SHA256
| project TimeGenerated, DeviceName, FileName, FolderPath, FileHash, InitiatingProcessFileName
| order by TimeGenerated desc

// Hunt for rapid clipboard access events (requires specialized telemetry)
DeviceEvents
| where TimeGenerated > ago(24h)
| where ActionType == "ClipboardDataRead"
| where InitiatingProcessFileName in~ ("chrome.exe", "firefox.exe", "msedge.exe")
| summarize ClipboardReads = count() by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 5m)
| where ClipboardReads > 10
| order by ClipboardReads desc

-- Hunt for browsers spawning suspicious child processes
-- This can indicate malicious JavaScript attempting system-level operations

SELECT 
    Pid,
    Ppid,
    Name as ProcessName,
    CommandLine,
    Exe as ProcessPath,
    Username,
    CreateTime,
    (SELECT Name FROM pslist(pid=Ppid)) as ParentProcess
FROM pslist()
WHERE 
    (
        ParentProcess =~ '(chrome|firefox|msedge|brave)\.exe$'
        AND Name =~ '(powershell|cmd|wscript|cscript|mshta|rundll32|regsvr32)\.exe$'
    )
ORDER BY CreateTime DESC
LIMIT 100

-- Additional hunt: Browser processes with unusual network connections
SELECT 
    Pid,
    Name,
    Exe,
    Username,
    CommandLine
FROM pslist()
WHERE 
    Name =~ '(chrome|firefox|msedge)\.exe$'
    AND Pid IN (
        SELECT Pid 
        FROM netstat()
        WHERE 
            RemoteAddress !~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)'
            AND Status == 'ESTABLISHED'
    )
ORDER BY CreateTime DESC

# PowerShell script to audit and harden browser security settings
# Run with administrative privileges

Write-Host "=== Browser Security Audit and Hardening ===" -ForegroundColor Cyan
Write-Host "Timestamp: $(Get-Date)" -ForegroundColor Cyan

# Check for suspicious browser child processes in event logs
Write-Host "`n[*] Checking for suspicious browser child process execution..." -ForegroundColor Yellow
$SuspiciousProcesses = Get-WinEvent -FilterHashtable @{
    LogName = 'Security'
    ID = 4688
} -MaxEvents 1000 -ErrorAction SilentlyContinue | Where-Object {
    $_.Message -match 'chrome\.exe|firefox\.exe|msedge\.exe' -and
    $_.Message -match 'powershell\.exe|cmd\.exe|wscript\.exe|cscript\.exe|mshta\.exe'
}

if ($SuspiciousProcesses) {
    Write-Host "[!] WARNING: Found $($SuspiciousProcesses.Count) suspicious browser child process events" -ForegroundColor Red
    $SuspiciousProcesses | Select-Object -First 5 | ForEach-Object {
        Write-Host "    - $($_.TimeCreated): $($_.Message)" -ForegroundColor Red
    }
} else {
    Write-Host "[+] No suspicious browser child processes detected" -ForegroundColor Green
}

# Check browser extension inventory
Write-Host "`n[*] Enumerating browser extensions..." -ForegroundColor Yellow
$ChromeExtensionPath = "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions"
$EdgeExtensionPath = "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Extensions"

if (Test-Path $ChromeExtensionPath) {
    $ChromeExtensions = Get-ChildItem $ChromeExtensionPath -Directory
    Write-Host "[+] Found $($ChromeExtensions.Count) Chrome extensions" -ForegroundColor Green
    $ChromeExtensions | ForEach-Object {
        Write-Host "    - $($_.Name)" -ForegroundColor Cyan
    }
}

if (Test-Path $EdgeExtensionPath) {
    $EdgeExtensions = Get-ChildItem $EdgeExtensionPath -Directory
    Write-Host "[+] Found $($EdgeExtensions.Count) Edge extensions" -ForegroundColor Green
}

# Check for Subresource Integrity (SRI) support via Group Policy
Write-Host "`n[*] Checking Content Security Policy enforcement..." -ForegroundColor Yellow
$CSPKey = "HKLM:\SOFTWARE\Policies\Google\Chrome"
if (Test-Path $CSPKey) {
    Write-Host "[+] Chrome Group Policy configured" -ForegroundColor Green
} else {
    Write-Host "[!] No Chrome Group Policy found - consider implementing CSP enforcement" -ForegroundColor Yellow
}

# Audit recently downloaded JavaScript files
Write-Host "`n[*] Checking for recently downloaded JavaScript files..." -ForegroundColor Yellow
$RecentJS = Get-ChildItem -Path "$env:USERPROFILE\Downloads" -Filter "*.js" -Recurse -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) }

if ($RecentJS) {
    Write-Host "[!] Found $($RecentJS.Count) JavaScript files downloaded in the last 7 days" -ForegroundColor Yellow
    $RecentJS | Select-Object Name, LastWriteTime, Length | Format-Table -AutoSize
} else {
    Write-Host "[+] No recent JavaScript downloads detected" -ForegroundColor Green
}

# Check network connections from browsers
Write-Host "`n[*] Analyzing current browser network connections..." -ForegroundColor Yellow
$BrowserConnections = Get-NetTCPConnection -State Established | Where-Object {
    $_.OwningProcess -in (Get-Process | Where-Object { $_.ProcessName -match 'chrome|firefox|msedge' }).Id
} | Select-Object -First 10

if ($BrowserConnections) {
    Write-Host "[+] Current browser connections:" -ForegroundColor Cyan
    $BrowserConnections | ForEach-Object {
        $Process = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        Write-Host "    - $($Process.ProcessName): $($_.RemoteAddress):$($_.RemotePort)" -ForegroundColor Cyan
    }
}

# Recommendations
Write-Host "`n=== Recommendations ===" -ForegroundColor Cyan
Write-Host "1. Implement Subresource Integrity (SRI) for all third-party scripts" -ForegroundColor White
Write-Host "2. Deploy Content Security Policy (CSP) with strict script-src directives" -ForegroundColor White
Write-Host "3. Enable browser isolation for high-risk users or transactions" -ForegroundColor White
Write-Host "4. Implement network segmentation for financial transaction systems" -ForegroundColor White
Write-Host "5. Deploy endpoint detection and response (EDR) solutions with script blocking" -ForegroundColor White
Write-Host "6. Regularly audit third-party dependencies and CDN configurations" -ForegroundColor White

Write-Host "`n=== Audit Complete ===" -ForegroundColor Cyan

<script 
  src="https://third-party-cdn.com/script.js"
  integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
  crossorigin="anonymous">
</script>

# Generate SHA-384 hash for a script
curl -s https://third-party-cdn.com/script.js | openssl dgst -sha384 -binary | openssl base64 -A

# For local files
cat script.js | openssl dgst -sha384 -binary | openssl base64 -A

Content-Security-Policy: script-src 'self' https://trusted-cdn.com 'sha256-BASE64_HASH'; object-src 'none'; base-uri 'self'; upgrade-insecure-requests

Content-Security-Policy-Report-Only: script-src 'self'; report-uri https://your-domain.com/csp-reports

// Verify script integrity before execution
async function loadThirdPartyScript(url, expectedHash) {
  try {
    const response = await fetch(url);
    const scriptContent = await response.text();
    
    // Calculate hash
    const hashBuffer = await crypto.subtle.digest('SHA-384', new TextEncoder().encode(scriptContent));
    const hashArray = Array.from(new Uint8Array(hashBuffer));
    const hashBase64 = btoa(String.fromCharCode.apply(null, hashArray));
    
    // Verify hash matches expected value
    if (hashBase64 === expectedHash) {
      const script = document.createElement('script');
      script.textContent = scriptContent;
      document.head.appendChild(script);
      return true;
    } else {
      console.error('Script integrity verification failed');
      // Alert security team
      fetch('/api/security-alert', {
        method: 'POST',
        body: JSON.stringify({type: 'script_integrity_failure', url: url})
      });
      return false;
    }
  } catch (error) {
    console.error('Failed to load script:', error);
    return false;
  }
}

#!/bin/bash
# Script to monitor third-party JavaScript for unauthorized changes

SCRIPT_URL="https://third-party-cdn.com/monitoring-script.js"
HASH_FILE="/var/security/script_hashes.txt"
ALERT_EMAIL="security@yourdomain.com"

# Create hash file if it doesn't exist
if [ ! -f "$HASH_FILE" ]; then
    echo "$(curl -s "$SCRIPT_URL" | sha256sum | awk '{print $1}') $SCRIPT_URL" > "$HASH_FILE"
    echo "Initial hash recorded for $SCRIPT_URL"
    exit 0
fi

# Get current hash
CURRENT_HASH=$(curl -s "$SCRIPT_URL" | sha256sum | awk '{print $1}')
STORED_HASH=$(grep "$SCRIPT_URL" "$HASH_FILE" | awk '{print $1}')

# Compare hashes
if [ "$CURRENT_HASH" != "$STORED_HASH" ]; then
    echo "WARNING: Script hash mismatch detected for $SCRIPT_URL"
    echo "Expected: $STORED_HASH"
    echo "Current:  $CURRENT_HASH"
    
    # Send alert
    echo "Third-party script modification detected: $SCRIPT_URL" | \
        mail -s "SECURITY ALERT: Third-Party Script Modified" "$ALERT_EMAIL"
    
    # Log to SIEM
    logger -t security-monitor "Third-party script hash mismatch: $SCRIPT_URL"
else
    echo "Script integrity verified: $SCRIPT_URL"
fi

Update IR playbooks for third-party script compromise: