Browser Cache Smuggling Payload Extraction And Execution

Query

let Lookback = 75m;
let PivotWindow = 10m;
let CacheRegex = @"(?i)(cache2[\\/]entries|[\\/]Cache_Data)";
let Readers = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","python.exe","pythonw.exe","node.exe","tar.exe","expand.exe","7z.exe","xcopy.exe","robocopy.exe","certutil.exe","curl.exe"]);
let ExecutableExt = @"(?i)\.(exe|dll|ps1|js|jse|vbs|vbe|wsf|hta|bat|cmd|scr|msi|jar|lnk|cpl)$";
let Anchors = DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where FileName in~ (Readers)
    | where ProcessCommandLine matches regex CacheRegex
    | where isnotempty(ProcessUniqueId)
    | project DeviceId, DeviceName, AnchorTime = Timestamp, AnchorId = ProcessUniqueId, AnchorCmd = ProcessCommandLine;
let AnchorIds = toscalar(Anchors | summarize make_set(AnchorId));
// Process family: anchor plus direct child processes
let Family = Anchors
    | project DeviceId, DeviceName, AnchorTime, AnchorCmd, AnchorId, MemberId = AnchorId
    | union (
        DeviceProcessEvents
        | where Timestamp > ago(Lookback + PivotWindow)
        | where InitiatingProcessUniqueId in (AnchorIds)
        | project DeviceId, MemberId = ProcessUniqueId, AnchorId = InitiatingProcessUniqueId
        | join kind=inner (Anchors) on DeviceId, AnchorId
        | project DeviceId, DeviceName, AnchorTime, AnchorCmd, AnchorId, MemberId
    );
let FamilyIds = toscalar(Family | summarize make_set(MemberId));
let Writes = materialize(
    DeviceFileEvents
    | where Timestamp > ago(Lookback + PivotWindow)
    | where InitiatingProcessUniqueId in (FamilyIds)
    | where ActionType in ("FileCreated", "FileModified", "FileRenamed")
    | where not(FolderPath matches regex CacheRegex)
    | project DeviceId, WriterId = InitiatingProcessUniqueId, WriteTime = Timestamp,
        PayloadPath = strcat(FolderPath, "\\", FileName), PayloadName = FileName
    | join kind=inner (Family) on DeviceId, $left.WriterId == $right.MemberId
    | where WriteTime between (AnchorTime .. (AnchorTime + PivotWindow))
    | extend ExecutableLike = PayloadName matches regex ExecutableExt
    | project DeviceId, DeviceName, AnchorCmd, WriteTime, PayloadPath, PayloadName, ExecutableLike
);
let WriteDevices = toscalar(Writes | summarize make_set(DeviceId));
Writes
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(Lookback + 2 * PivotWindow)
    | where DeviceId in (WriteDevices)
    | project DeviceId, ReportId, ExecutionTime = Timestamp,
        ExecPath = strcat(FolderPath, "\\", FileName),
        ExecCmd = ProcessCommandLine,
        ExecAccount = AccountName,
        ExecParentId = InitiatingProcessUniqueId
) on DeviceId
| where ExecutionTime between (WriteTime .. (WriteTime + PivotWindow))
| where ExecPath =~ PayloadPath
    or ExecCmd contains PayloadPath
    // relative invocations (e.g. "cd /d %TEMP% && start a.exe"), limited to children of the anchor family
    or (ExecParentId in (FamilyIds) and ExecCmd contains PayloadName)
| project Timestamp = ExecutionTime, ReportId, DeviceId, DeviceName, ExecAccount,
    Evidence = "Cache path mentioned in process command line; file read is not observable",
    ExecutableLike, AnchorCmd, PayloadPath, WriteTime, ExecPath, ExecCmd

About this query

Explanation

This query is designed to detect potential browser cache smuggling attacks. Here's a simplified explanation of what it does:

Purpose: The query aims to identify malicious activities where harmful payloads are delivered through the browser cache. These payloads might be disguised as harmless files like images and are later extracted and executed by scripts or tools.
Detection Method:
- It looks for processes that are known to read files (like script hosts or archive tools) and checks if their command lines mention browser cache locations.
- These processes and their direct child processes are tracked as a group, referred to as the "anchor family."
File Monitoring:
- The query monitors for any files created, modified, or renamed by this anchor family, excluding the cache folders themselves.
- It then checks if any of these files are executed on the same device, either by their full path or just by their name if executed by a member of the anchor family.
Output:
- The results include a flag indicating if the payload has an executable or script extension, which helps in identifying potentially harmful files.
- The query does not directly confirm that the cache was read, as it infers this from the command line. It also doesn't cover fileless attacks that don't write payloads to disk.
Customization:
- The query allows for tuning parameters like the lookback period and pivot window to fit different environments.
- It also suggests adding exclusions for legitimate scripts that access browser cache folders.
Alert Management:
- With a rule frequency of one hour, the query overlaps alerts by 15 minutes to ensure coverage, and it recommends deduplicating alerts by a unique report identifier.

Overall, this query helps security teams detect and investigate potential browser cache smuggling attacks by analyzing process activities and file operations related to browser cache access.