{"id":"b64a026b-8deb-4c1d-92fd-98893209dff1","title":"Running Chrome VPN Extensions via the Registry 2 VPN Extension","description":"Running Chrome VPN Extensions via the Registry install 2 vpn extension","author":"frack113","status":"test","level":"high","date":"2021-12-28","modified":"2023-08-17","tags":["attack.initial-access","attack.persistence","attack.t1133"],"technique_ids":["T1133"],"logsource":{"category":"registry_set","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1133/T1133.md#atomic-test-1---running-chrome-vpn-extensions-via-the-registry-2-vpn-extension"],"source_path":"rules/windows/registry/registry_set/registry_set_chrome_extension.yml","source_sha256":"43a6007410fe769cd6860eb638ce9f069382b43f2e1ab933602f76d5c5b0f193","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_chrome_extension.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Running Chrome VPN Extensions via the Registry 2 VPN Extension\nid: b64a026b-8deb-4c1d-92fd-98893209dff1\nstatus: test\ndescription: Running Chrome VPN Extensions via the Registry install 2 vpn extension\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1133/T1133.md#atomic-test-1---running-chrome-vpn-extensions-via-the-registry-2-vpn-extension\nauthor: frack113\ndate: 2021-12-28\nmodified: 2023-08-17\ntags:\n    - attack.initial-access\n    - attack.persistence\n    - attack.t1133\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    chrome_ext:\n        TargetObject|contains: 'Software\\Wow6432Node\\Google\\Chrome\\Extensions'\n        TargetObject|endswith: 'update_url'\n    chrome_vpn:\n        TargetObject|contains:\n            - fdcgdnkidjaadafnichfpabhfomcebme # ZenMate VPN\n            - fcfhplploccackoneaefokcmbjfbkenj # 1clickVPN\n            - bihmplhobchoageeokmgbdihknkjbknd # Touch VPN\n            - gkojfkhlekighikafcpjkiklfbnlmeio # Hola Free VPN\n            - jajilbjjinjmgcibalaakngmkilboobh # Astar VPN\n            - gjknjjomckknofjidppipffbpoekiipm # VPN Free\n            - nabbmpekekjknlbkgpodfndbodhijjem # Earth VPN\n            - kpiecbcckbofpmkkkdibbllpinceiihk # DotVPN\n            - nlbejmccbhkncgokjcmghpfloaajcffj # Hotspot Shield Free VPN\n            - omghfjlpggmjjaagoclmmobgdodcjboh # Browsec VPN\n            - bibjcjfmgapbfoljiojpipaooddpkpai # VPN-free.pro\n            - mpcaainmfjjigeicjnlkdfajbioopjko # VPN Unlimited Free\n            - jljopmgdobloagejpohpldgkiellmfnc # PP VPN\n            - lochiccbgeohimldjooaakjllnafhaid # IP Unblock\n            - nhnfcgpcbfclhfafjlooihdfghaeinfc # Surf VPN\n            - ookhnhpkphagefgdiemllfajmkdkcaim # iNinja VPN\n            - namfblliamklmeodpcelkokjbffgmeoo # Daily VPN\n            - nbcojefnccbanplpoffopkoepjmhgdgh # Hoxx VPN Proxy\n            - majdfhpaihoncoakbjgbdhglocklcgno # Free VPN\n            - lnfdmdhmfbimhhpaeocncdlhiodoblbd # VPN PROXY MASTER\n            - eppiocemhmnlbhjplcgkofciiegomcon # Urban Free VPN\n            - cocfojppfigjeefejbpfmedgjbpchcng # SaferVPN Proxy\n            - foiopecknacmiihiocgdjgbjokkpkohc # VPN Professional\n            - hhdobjgopfphlmjbmnpglhfcgppchgje # AdGuard VPN\n            - jgbaghohigdbgbolncodkdlpenhcmcge # Free VPN\n            - inligpkjkhbpifecbdjhmdpcfhnlelja # Free One Touch VPN\n            - higioemojdadgdbhbbbkfbebbdlfjbip # Unlimited VPN & Proxy by ibVPN\n            - hipncndjamdcmphkgngojegjblibadbe # RusVPN\n            - iolonopooapdagdemdoaihahlfkncfgg # Azino VPN\n            - nhfjkakglbnnpkpldhjmpmmfefifedcj # Pron VPN\n            - jpgljfpmoofbmlieejglhonfofmahini # Free Residential VPN\n            - fgddmllnllkalaagkghckoinaemmogpe # ExpressVPN\n            - ejkaocphofnobjdedneohbbiilggdlbi # Hotspot Shield Elite VPN Proxy\n            - keodbianoliadkoelloecbhllnpiocoi # Hide My IP VPN\n            - hoapmlpnmpaehilehggglehfdlnoegck # Tunnello VPN\n            - poeojclicodamonabcabmapamjkkmnnk # HMA VPN Proxy Unblocker\n            - dfkdflfgjdajbhocmfjolpjbebdkcjog # Free Avira Phantom VPN\n            - kcdahmgmaagjhocpipbodaokikjkampi # Hola VPN\n            - klnkiajpmpkkkgpgbogmcgfjhdoljacg # Free VPN for Chrome\n            - lneaocagcijjdpkcabeanfpdbmapcjjg # Hub VPN\n            - pgfpignfckbloagkfnamnolkeaecfgfh # Free Proxy VPN\n            - jplnlifepflhkbkgonidnobkakhmpnmh # Private Internet Access\n            - jliodmnojccaloajphkingdnpljdhdok # Turbo VPN for PC\n            - hnmpcagpplmpfojmgmnngilcnanddlhb # Windscribe\n            - ffbkglfijbcbgblgflchnbphjdllaogb # CyberGhost VPN\n            - kcndmbbelllkmioekdagahekgimemejo # VPN.AC\n            - jdgilggpfmjpbodmhndmhojklgfdlhob # Browser VPN\n            - bihhflimonbpcfagfadcnbbdngpopnjb # DEEPRISM VPN\n            - ppajinakbfocjfnijggfndbdmjggcmde # My Browser Vpn\n            - oofgbpoabipfcfjapgnbbjjaenockbdp # SetupVPN\n            - bhnhkdgoefpmekcgnccpnhjfdgicfebm # Wachee VPN\n            - knmmpciebaoojcpjjoeonlcjacjopcpf # Thunder Proxy\n            - dhadilbmmjiooceioladdphemaliiobo # Free Proxy VPN\n            - jedieiamjmoflcknjdjhpieklepfglin # FastestVPN Proxy\n            - mhngpdlhojliikfknhfaglpnddniijfh # WorkingVPN\n            - omdakjcmkglenbhjadbccaookpfjihpa # TunnelBear VPN\n            - npgimkapccfidfkfoklhpkgmhgfejhbj # BelkaVPN\n            - akeehkgglkmpapdnanoochpfmeghfdln # VPN Master\n            - gbmdmipapolaohpinhblmcnpmmlgfgje # Unblock Websites\n            - aigmfoeogfnljhnofglledbhhfegannp # Lethean Proxy VPN\n            - cgojmfochfikphincbhokimmmjenhhgk # Whoer VPN\n            - ficajfeojakddincjafebjmfiefcmanc # Best VPN USA\n            - ifnaibldjfdmaipaddffmgcmekjhiloa # FREE VPN DEWELOPMENT\n            - jbnmpdkcfkochpanomnkhnafobppmccn # apkfold free vpn\n            - apcfdffemoinopelidncddjbhkiblecc # Soul VPN\n            - mjolnodfokkkaichkcjipfgblbfgojpa # DotVPN\n            - oifjbnnafapeiknapihcmpeodaeblbkn # rderzh VPN Proxy\n            - plpmggfglncceinmilojdkiijhmajkjh # Red Panda VPN\n            - mjnbclmflcpookeapghfhapeffmpodij # Ultrareach VPN\n            - bblcccknbdbplgmdjnnikffefhdlobhp # FastStunnel VPN\n            - aojlhgbkmkahabcmcpifbolnoichfeep # VirtualShield VPN\n            - lcmammnjlbmlbcaniggmlejfjpjagiia # Adblock Office VPN Proxy Server\n            - knajdeaocbpmfghhmijicidfcmdgbdpm # Guru VPN & Proxy\n            - bdlcnpceagnkjnjlbbbcepohejbheilk # Malus VPN\n            - edknjdjielmpdlnllkdmaghlbpnmjmgb # Muscle VPN\n            - eidnihaadmmancegllknfbliaijfmkgo # Push VPN\n            - ckiahbcmlmkpfiijecbpflfahoimklke # Gom VPN\n            - macdlemfnignjhclfcfichcdhiomgjjb # Free Fast VPN\n            - chioafkonnhbpajpengbalkececleldf # BullVPN\n            - amnoibeflfphhplmckdbiajkjaoomgnj # HideAll VPN\n            - llbhddikeonkpbhpncnhialfbpnilcnc # ProxyFlow\n            - pcienlhnoficegnepejpfiklggkioccm # Cloud VPN\n            - iocnglnmfkgfedpcemdflhkchokkfeii # sVPN\n            - igahhbkcppaollcjeaaoapkijbnphfhb # Social VPN\n            - njpmifchgidinihmijhcfpbdmglecdlb # Trellonet Trellonet\n            - ggackgngljinccllcmbgnpgpllcjepgc # WindmillVPN\n            - kchocjcihdgkoplngjemhpplmmloanja # IPBurger Proxy & VPN\n            - bnijmipndnicefcdbhgcjoognndbgkep # Veee\n            - lklekjodgannjcccdlbicoamibgbdnmi # Anonymous Proxy Vpn Browser\n            - dbdbnchagbkhknegmhgikkleoogjcfge # Hideman VPN\n            - egblhcjfjmbjajhjhpmnlekffgaemgfh # Fornex VPN\n            - ehbhfpfdkmhcpaehaooegfdflljcnfec # WeVPN\n            - bkkgdjpomdnfemhhkalfkogckjdkcjkg # VPNMatic\n            - almalgbpmcfpdaopimbdchdliminoign # Urban Shield\n            - akkbkhnikoeojlhiiomohpdnkhbkhieh # Prime VPN\n            - gbfgfbopcfokdpkdigfmoeaajfmpkbnh # westwind\n            - bniikohfmajhdcffljgfeiklcbgffppl # Upnet\n            - lejgfmmlngaigdmmikblappdafcmkndb # uVPN\n            - ffhhkmlgedgcliajaedapkdfigdobcif # Nucleus VPN\n            - gcknhkkoolaabfmlnjonogaaifnjlfnp # FoxyProxy Standard\n            - pooljnboifbodgifngpppfklhifechoe # GeoProxy\n            - fjoaledfpmneenckfbpdfhkmimnjocfa # NordVPN\n            - aakchaleigkohafkfjfjbblobjifikek # ProxFlow\n            - dpplabbmogkhghncfbfdeeokoefdjegm # Proxy SwitchySharp\n            - padekgcemlokbadohgkifijomclgjgif # Proxy SwitchyOmega\n            - bfidboloedlamgdmenmlbipfnccokknp # PureVPN\n    condition: all of chrome_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1133","id":"T1133","name":"External Remote Services","page":"techniques/enterprise/T1133/"}],"data_path":"data/detection-rules/b64a026b-8deb-4c1d-92fd-98893209dff1.json","kind":"sigma"}