Threat video1:00
Chrome 157.0.8103.38 RCE Fixes: Detection & IOCs
Chrome flaws before 157.0.8103.38 let a crafted page trigger RCE or sandbox escape. Track them with 9 detection rules, 5 IOCs and a free Splunk SPL rule.
Read the full threat intel for Multiple Vulnerabilities in Google Chrome prior to 157.0.8103.38… →
Chapters
- 0:00The hookGoogle Chrome patch closes sandbox escape vulnerabilities.
- 0:05The storyRoughly 230 flaws: sandbox escape and site isolation bypass.
- 0:13Attack pathAttackers lure users to crafted web pages.
- 0:26AttributionNo threat actor is attributed.
- 0:31Indicators of compromise2 indicators to hunt: 1 file name and 1 package name.
- 0:37MITRE ATT&CK techniques3 ATT&CK techniques, from execution to persistence.
- 0:42Remediation2 steps now: Update Google Chrome.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Google Chrome patch closes sandbox escape vulnerabilities.
0:05Roughly 230 flaws: sandbox escape and site isolation bypass.
0:10Update your browser.
0:13Attackers lure users to crafted web pages.
0:16A DOM flaw executes code inside the browser.
0:26No threat actor is attributed. Confidence: low.
0:312 indicators to hunt: 1 file name and 1 package name.
0:383 ATT&CK techniques, from execution to persistence.
0:432 steps now: Update Google Chrome.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.