Threat video1:00
Searchjacked Chrome Extensions (319): Detection & IOCs
Searchjacked extensions reroute searches through operator proxies to Bing or Yahoo, with 9 detection rules, 20 IOCs and a free Splunk SPL rule.
Read the full threat intel for Searchjacked Chrome Extensions (319): Detection & IOCs →
Chapters
- 0:00The hook319 extensions hijacked roughly 13.4M searches.
- 0:06The storyFor ten years, fake utilities hid inside Chrome extensions.
- 0:13Attack pathFake extensions posed as utilities in ads.
- 0:28AttributionNo threat actor is attributed.
- 0:32Indicators of compromise8 indicators to hunt: 7 domains and 1 file name.
- 0:38MITRE ATT&CK techniques8 ATT&CK techniques, from resource development to impact.
- 0:43Remediation4 steps now: Inventory browser extensions across the fleet and remove those listed.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00319 extensions hijacked roughly 13.4M searches.
0:07For ten years, fake utilities hid inside Chrome extensions.
0:11Proxying every query.
0:13Fake extensions posed as utilities in ads.
0:16Users installed; they hijacked the search provider.
0:20Every query routed through operator servers.
0:23Forwarded to Yahoo, Bing for revenue.
0:28No threat actor is attributed. Confidence: medium.
0:338 indicators to hunt: 7 domains and 1 file name.
0:388 ATT&CK techniques, from resource development to impact.
0:434 steps now: Inventory browser extensions across the fleet and remove those listed.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.