Google Chromium V8 Type Confusion Exploitation (CVE-2025-13223)

let suspiciousChromeChildren = DeviceProcessEvents
| where FileName in~ ("chrome.exe", "msedge.exe", "brave.exe")
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "brave.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "wmic.exe", "msiexec.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessId, ProcessId;
let crashDumps = DeviceFileEvents
| where FolderPath has_any ("Crashpad", "CrashDumps", "crash-reports")
| where FileName endswith ".dmp" or FileName endswith ".crash"
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "brave.exe")
| project TimeGenerated, DeviceName, AccountName, FolderPath, FileName, InitiatingProcessFileName;
let networkAfterBrowser = DeviceNetworkEvents
| where InitiatingProcessFileName in~ ("cmd.exe", "powershell.exe", "rundll32.exe", "mshta.exe")
| where InitiatingProcessParentFileName in~ ("chrome.exe", "msedge.exe", "brave.exe")
| project TimeGenerated, DeviceName, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine;
union suspiciousChromeChildren, crashDumps, networkAfterBrowser
| sort by TimeGenerated desc

index=endpoint sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational", "crowdstrike:events:sensor", "sentinelone:alerts")
| eval parent_lower=lower(ParentImage)
| eval proc_lower=lower(Image)
| where match(parent_lower, "(chrome|msedge|brave)\.exe$")
  AND match(proc_lower, "(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|wmic|msiexec)\.exe$")
| eval risk_score=case(
    match(proc_lower, "(powershell|cmd)\.exe"), 90,
    match(proc_lower, "(mshta|regsvr32|rundll32)\.exe"), 95,
    true(), 70
  )
| eval detection_context="CVE-2025-13223: Suspicious child process from Chromium V8 exploitation"
| table _time, host, user, ParentImage, ParentCommandLine, Image, CommandLine, ProcessId, ParentProcessId, risk_score, detection_context
| sort -risk_score, -_time

``` Alternative: crash dump indicator ```
index=endpoint sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational")
  EventCode=11
| eval target_lower=lower(TargetFilename)
| where match(target_lower, "(crashpad|crashdumps|crash-reports).*\.(dmp|crash)$")
| eval initiating_lower=lower(Image)
| where match(initiating_lower, "(chrome|msedge|brave)\.exe$")
| table _time, host, user, Image, TargetFilename
| eval detection_context="CVE-2025-13223: Browser crash dump — possible V8 exploit"

sequence by host.name with maxspan=2m
  [process where event.type == "start"
    and process.name : ("chrome.exe", "msedge.exe", "brave.exe", "chromium.exe")
    and process.parent.name : ("explorer.exe", "svchost.exe", "userinit.exe")]
  [process where event.type == "start"
    and process.parent.name : ("chrome.exe", "msedge.exe", "brave.exe", "chromium.exe")
    and process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe",
                         "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe",
                         "bitsadmin.exe", "wmic.exe", "msiexec.exe", "schtasks.exe")]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  "sourceip",
  "username",
  "Application" AS parent_process,
  QIDNAME(qid) AS event_name,
  "Process Name" AS child_process,
  "Command" AS command_line,
  logsourcename(logsourceid) AS log_source
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND (
    ("Application" ILIKE '%chrome.exe%' OR "Application" ILIKE '%msedge.exe%' OR "Application" ILIKE '%brave.exe%')
    AND
    ("Process Name" ILIKE '%cmd.exe%'
      OR "Process Name" ILIKE '%powershell.exe%'
      OR "Process Name" ILIKE '%wscript.exe%'
      OR "Process Name" ILIKE '%mshta.exe%'
      OR "Process Name" ILIKE '%rundll32.exe%'
      OR "Process Name" ILIKE '%regsvr32.exe%'
      OR "Process Name" ILIKE '%certutil.exe%'
      OR "Process Name" ILIKE '%cscript.exe%')
  )
  AND LOGSOURCENAME(logsourceid) NOT ILIKE '%test%'
  AND starttime > NOW() - 24 HOURS
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=endpoint/windows/sysmon OR _sourceCategory=endpoint/crowdstrike
| json auto
| where (%"event_type" = "ProcessCreate" OR EventID = "1")
| eval parent = toLowerCase(%"ParentImage")
| eval child = toLowerCase(%"Image")
| where (parent matches "*chrome.exe" OR parent matches "*msedge.exe" OR parent matches "*brave.exe")
| where (child matches "*cmd.exe" OR child matches "*powershell.exe" OR child matches "*wscript.exe"
  OR child matches "*cscript.exe" OR child matches "*mshta.exe" OR child matches "*rundll32.exe"
  OR child matches "*regsvr32.exe" OR child matches "*certutil.exe")
| eval severity = "CRITICAL"
| eval cve = "CVE-2025-13223"
| eval detection_name = "Chromium V8 Type Confusion - Suspicious Child Process"
| fields _messageTime, host, user, parent, child, %"CommandLine", %"ProcessId", %"ParentProcessId", severity, cve, detection_name
| sort by _messageTime desc

rule cve_2025_13223_chromium_v8_type_confusion {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects suspicious child processes spawned by Chromium-based browsers, indicative of CVE-2025-13223 V8 type confusion exploitation and sandbox escape"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-13223"
    cve = "CVE-2025-13223"

  events:
    $spawn.metadata.event_type = "PROCESS_LAUNCH"
    $spawn.principal.process.file.full_path = /(?i)(chrome|msedge|brave|chromium)\.exe$/
    $spawn.target.process.file.full_path = /(?i)(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|wmic|msiexec)\.exe$/

  condition:
    $spawn
}

event_simpleName=ProcessRollup2
| ParentBaseFileName IN ("chrome.exe", "msedge.exe", "brave.exe", "chromium.exe")
| FileName IN ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe",
               "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe",
               "wmic.exe", "msiexec.exe", "schtasks.exe", "at.exe")
| eval detection="CVE-2025-13223: Chromium V8 Sandbox Escape - Suspicious Child Process"
| eval severity="CRITICAL"
| table _time, ComputerName, UserName, ParentBaseFileName, ParentCommandLine,
         FileName, CommandLine, TargetProcessId, SourceProcessId, detection, severity
| sort -_time
| head 500