ThreatsDay Roundup: 200 Android Flaws, Malicious Browser Extensions, and 119K Scam Shops — A Defender's Playbook

---
title: Browser Process Spawning Script Interpreter (ClickFix / Extension Abuse)
id: 8f3a1c92-4d7b-4e5a-9c21-2b6d8e4f7a10
status: experimental
description: Detects browsers spawning PowerShell, cmd, mshta, or wscript — a hallmark of ClickFix-style paste-and-run social engineering and malicious extension execution. Browsers should never parent script interpreters in normal operation.
references:
  - https://attack.mitre.org/techniques/T1204/
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/09/18
tags:
  - attack.execution
  - attack.t1204
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\opera.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate browser-launched enterprise installers (verify parent command line)
level: high
---
title: Run Dialog or Explorer Spawned Encoded PowerShell (ClickFix Pattern)
id: 2c7e5b18-9a3f-4d61-8e44-5a9c1f3b6d02
status: experimental
description: Detects encoded or download-cradle PowerShell launched from explorer.exe or the Run dialog context, consistent with ClickFix lures that instruct victims to paste commands manually.
references:
  - https://attack.mitre.org/techniques/T1059/001/
  - https://attack.mitre.org/techniques/T1027/
author: Security Arsenal
date: 2026/09/18
tags:
  - attack.execution
  - attack.t1059.001
  - attack.defense_evasion
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_image:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
  selection_cli:
    CommandLine|contains:
      - ' -enc'
      - ' -e '
      - 'FromBase64String'
      - 'IEX'
      - 'Invoke-Expression'
      - 'DownloadString'
      - 'Start-BitsTransfer'
  condition: selection_parent and selection_image and selection_cli
falsepositives:
  - Admin quick-launch of encoded commands (should be rare; investigate each hit)
level: high
---
title: New Browser Extension Installed Outside Enterprise Policy
id: 5b9d2e71-6c4a-4f83-b217-8e3d7a5c9f14
status: experimental
description: Detects writes to Chrome/Edge extension preference and registry locations that may indicate a sideloaded or user-installed extension outside centrally managed allowlists. Baseline before deployment.
references:
  - https://attack.mitre.org/techniques/T1176/
author: Security Arsenal
date: 2026/09/18
tags:
  - attack.persistence
  - attack.t1176
logsource:
  category: registry_event
  product: windows
detection:
  selection:
    TargetObject|contains:
      - '\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist'
      - '\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist'
      - '\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\'
      - '\SOFTWARE\Wow6432Node\Microsoft\Edge\Extensions\'
  condition: selection
falsepositives:
  - Legitimate extension deployment via GPO or enterprise policy
  - First-run browser setup
level: medium

// Hunt: Browser-spawned script interpreters (ClickFix / malicious extension execution)
// High-fidelity — browsers should never parent script engines. Tune only for known enterprise installer flows.
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe")
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "mshta.exe", "wscript.exe", "cscript.exe", "rundll32.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ReportId
| order by TimeGenerated desc;

// Hunt: Outbound connections to newly registered domains (scam shop infrastructure)
// Assumes ingestion of proxy/firewall logs via CommonSecurityLog (CEF) or Defender network events.
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where isnotempty(RemoteUrl)
| join kind=leftouter (
    // If you maintain a domain-age enrichment table or use a TI feed, join here.
    // Placeholder illustrates correlation against your scam-shop/TI indicator list.
    externaldata(IndicatorValue:string)[h@"https://your-ti-feed.example/scam-shops.csv"] with (format="csv")
    ) on $left.RemoteUrl == $right.IndicatorValue
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, ActionType
| order by TimeGenerated desc;

// Hunt: Syslog/CEF path for Linux-proxied or firewall-visible scam shop traffic
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceVendor in ("Palo Alto Networks", "Zscaler", "Fortinet", "Cisco")
| where isnotempty(RequestURL) or isnotempty(DestinationHostName)
| where RequestURL contains "shop" or DestinationHostName matches regex @"[a-z0-9-]{20,}\.(top|shop|xyz|icu|store)$"
| summarize ConnectionCount = count() by SourceIP, DestinationHostName, RequestURL, DeviceAction
| where ConnectionCount > 3
| order by ConnectionCount desc;

-- Hunt: Browser processes with suspicious children + enumerate installed Chrome/Edge extensions
-- Combines live process inspection with on-disk extension artifact collection.

SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(powershell|pwsh|cmd|mshta|wscript|cscript|rundll32)\.exe'
  AND Ppid IN (
      SELECT Pid FROM pslist()
      WHERE Name =~ '(?i)(chrome|msedge|firefox|brave|opera)\.exe'
  )

-- Separately, enumerate extension manifests across user profiles to inventory what's installed:
-- SELECT FullPath, Mtime, read_file(filename=FullPath, length=4096) AS ManifestHead
-- FROM glob(globs='C:/Users/*/AppData/Local/Google/Chrome/User Data/*/Extensions/*/*/manifest.json')
-- Review each manifest's "permissions" array for broad host access ("<all_urls>", "cookies", "webRequest").

# Browser Extension Audit + ClickFix Exposure Check
# Run via RMM/Intune/SCCM across the fleet. Outputs installed extensions with risky permissions.

$results = @()
$browserExtPaths = @(
    "$env:LOCALAPPDATA\Google\Chrome\User Data",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data"
)

# Enumerate all user profiles for multi-user systems
$profiles = Get-ChildItem "C:\Users" -Directory -ErrorAction SilentlyContinue
foreach ($profile in $profiles) {
    foreach ($base in $browserExtPaths) {
        $userBase = $base -replace [regex]::Escape($env:LOCALAPPDATA), "$($profile.FullName)\AppData\Local"
        $extDirs = Get-ChildItem "$userBase\*\Extensions" -Directory -ErrorAction SilentlyContinue
        foreach ($extDir in $extDirs) {
            $manifests = Get-ChildItem $extDir.FullName -Recurse -Filter "manifest.json" -ErrorAction SilentlyContinue
            foreach ($m in $manifests) {
                try {
                    $manifest = Get-Content $m.FullName -Raw | ConvertFrom-Json
                    $perms = @($manifest.permissions) + @($manifest.host_permissions)
                    $risky = $perms | Where-Object { $_ -match 'all_urls|cookies|webRequest|tabs|clipboardRead|<all_urls>' }
                    $results += [PSCustomObject]@{
                        User        = $profile.Name
                        ExtensionID = $extDir.Name
                        Name        = $manifest.name
                        Version     = $manifest.version
                        Permissions = ($perms -join ';')
                        RiskyPerms  = ($risky -join ';')
                        RiskFlag    = [bool]$risky
                    }
                } catch { }
            }
        }
    }
}

$results | Where-Object RiskFlag | Export-Csv "C:\ProgramData\ExtAudit_$(hostname)_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
Write-Output "Flagged $($($results | Where-Object RiskFlag).Count) extensions with high-risk permissions. Review CSV."

# Verify enterprise extension policy is enforced (Chrome + Edge)
$policies = @(
    'HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist',
    'HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallAllowlist',
    'HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist',
    'HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallBlocklist'
)
foreach ($p in $policies) {
    if (Test-Path $p) { Write-Output "[OK] Policy present: $p" }
    else { Write-Output "[MISSING] No policy at $p — extensions are user-controlled for this browser" }
}

# Check for suspicious RunMRU entries (ClickFix victims paste commands via Win+R)
$mru = Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" -ErrorAction SilentlyContinue
if ($mru) {
    $mru.PSObject.Properties | Where-Object { $_.Value -match 'powershell|mshta|cmd|curl|certutil|bitsadmin' } |
        ForEach-Object { Write-Output "[ALERT] Suspicious RunMRU entry: $($_.Value)" }
}

# Android fleet: verify patch compliance via MDM (Microsoft Graph example — requires appropriate module/scope)
# Get-MgDeviceManagementManagedDevice | Where-Object { $_.OperatingSystem -eq 'Android' } |
#   Select DeviceName, AndroidSecurityPatchLevel, ComplianceState |
#   Where-Object { [datetime]$_.AndroidSecurityPatchLevel -lt (Get-Date).AddDays(-45) }