UAT-11985 Google AitM Phishing Against Taiwan Research Affiliates: Detection and Hardening Guide

---
title: Proxy Access to Google Account Lookalike Hostname
id: 9d2a41b7-6f30-4c8e-9c11-7f0f2c6a8d41
status: experimental
description: Detects HTTP/S proxy requests where the Host/SNI contains Google-account themed strings but is not an allowlisted Google domain, consistent with AitM phishing relays.
references:
  - https://attack.mitre.org/techniques/T1566/002/
  - https://attack.mitre.org/techniques/T1557/
author: Security Arsenal
date: 2026/10/01
tags:
  - attack.initial_access
  - attack.t1566.002
  - attack.credential_access
  - attack.t1557
logsource:
  category: proxy
detection:
  selection:
    c-uri-host|contains:
      - 'accounts.google'
      - 'accounts-google'
      - 'google-accounts'
      - 'google.login'
      - 'login.google'
      - 'google.verify'
      - 'workspace.google'
  filter_google:
    c-uri-host|endswith:
      - '.google.com'
      - '.googleusercontent.com'
      - '.gstatic.com'
      - '.googleapis.com'
      - '.youtube.com'
      - '.google-analytics.com'
  condition: selection and not filter_google
falsepositives:
  - Squid or TLS inspection fields that capture only SNI may require normalization
  - Internal training phishing platforms should be explicitly allowlisted by domain and campaign ID
level: high
---
title: Browser Launched With Remote Debugging or Automation Flags
id: 3a8e0d54-52a1-4b3a-b9ef-41d2f6c91a70
status: experimental
description: Detects Chrome/Edge/Firefox started with remote debugging or automation switches. Not the phishing relay itself, but useful for post-compromise triage where stolen session material or browser automation is used to validate access.
references:
  - https://attack.mitre.org/techniques/T1185/
  - https://attack.mitre.org/techniques/T1539/
author: Security Arsenal
date: 2026/10/01
tags:
  - attack.collection
  - attack.t1539
  - attack.t1185
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  selection_cli:
    CommandLine|contains:
      - '--remote-debugging-port='
      - '--remote-debugging-pipe'
      - '--headless'
      - '--disable-extensions'
      - '--user-data-dir='
  condition: selection_img and selection_cli
falsepositives:
  - QA automation, Selenium/Playwright, accessibility tooling, and developer workstations
  - Tune by parent process, user role, and approved automation host list
level: medium

// Sentinel/Defender: hunt for Google-auth lookalike destinations observed by endpoint network events
let GoogleAuthLookalikes = dynamic(["accounts.google","accounts-google","google-accounts","login.google","google.login","workspace.google","google.verify"]);
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any (GoogleAuthLookalikes) or RemoteIP in (GoogleAuthLookalikes)
| where not(RemoteUrl endswith "google.com" or RemoteUrl endswith "googleusercontent.com" or RemoteUrl endswith "googleapis.com" or RemoteUrl endswith "gstatic.com")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType
| order by TimeGenerated desc;

// Sentinel via CEF/Syslog ingestion of Google Workspace audit or IdP-equivalent sign-in logs
// Normalize field names to your connector. Focus: first-seen source/ASN, success after MFA, then rapid recovery/OAuth changes.
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DeviceVendor has_any ("Google","Google Workspace") or DeviceProduct has_any ("Workspace","Google","Identity")
| where Activity has_any ("login","signin","oauth","2sv","mfa","recovery","forwarding","filter","grant")
| extend User = coalesce(DestinationUserName, SourceUserName)
| extend Msg = tostring(Message)
| where Msg has_any ("challenge","success","2sv","oauth","recovery email","recovery phone","filter created","forwarding enabled","granted")
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Sources=make_set(SourceIP, 20), Activities=make_set(Activity, 30), Sample=any(Msg) by User, bin(TimeGenerated, 1h)
| order by LastSeen desc;

-- Triage endpoints for browser automation/debugging and suspicious access to browser credential stores
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(remote-debugging-port|remote-debugging-pipe|headless|user-data-dir)'
   OR Name =~ '(?i)(chrome|msedge|firefox)'

-- List browser credential/profile artifacts touched recently for users implicated by sign-in alerts
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs='C:/Users/*/AppData/Local/{Google/Chrome,Microsoft/Edge}/User Data/**/{Login Data,Cookies,Network/Cookies,Web Data,History}', accessor='ntfs')
WHERE Mtime > now() - 86400*7
ORDER BY Mtime DESC

# Squid explicit-proxy hardening: allow only exact Google auth domains and deny Google-themed lookalikes
# Test in a staging proxy first. Requires TLS/SNI visibility or CONNECT host inspection; use only where lawful and disclosed.
set -euo pipefail
CONF=/etc/squid/conf.d/40-google-auth-allowlist.conf
sudo tee "$CONF" >/dev/null <<'EOF'
acl google_auth_exact dstdomain accounts.google.com
acl google_auth_exact dstdomain myaccount.google.com
acl google_auth_exact dstdomain gstatic.com
acl google_auth_exact dstdomain ssl.gstatic.com
acl google_auth_exact dstdomain googleapis.com
acl google_theme regex -i (accounts|login|signin|verify|workspace).*google|google.*(accounts|login|signin|verify|workspace)
http_access allow google_auth_exact
http_access deny google_theme !google_auth_exact
deny_info TCP_RESET google_theme
EOF
sudo squid -k parse
sudo systemctl reload squid
sudo grep -n "google_theme" /var/log/squid/access.log | tail -50 || true