CVE-2025-14174: Google Chromium Out of Bounds Memory Access Exploitation

let chromiumProcesses = dynamic(["chrome.exe", "msedge.exe", "brave.exe", "chromium.exe"]);
let suspiciousChildProcs = dynamic(["cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any (chromiumProcesses)
| where FileName has_any (suspiciousChildProcs)
| where InitiatingProcessParentFileName !has "explorer.exe" or isempty(InitiatingProcessParentFileName)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessId, ProcessId
| join kind=leftouter (
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName has_any (chromiumProcesses)
    | where RemotePort in (4444, 1337, 8080, 9001, 31337)
    | project TimeGenerated, DeviceName, InitiatingProcessId, RemoteIP, RemotePort, RemoteUrl
) on DeviceName, $left.InitiatingProcessId == $right.InitiatingProcessId
| extend RiskScore = case(
    FileName =~ "powershell.exe" and ProcessCommandLine has_any ("-enc", "-EncodedCommand", "IEX", "Invoke-Expression"), 90,
    FileName =~ "cmd.exe" and ProcessCommandLine has "/c", 70,
    isnotempty(RemoteIP), 80,
    50
  )
| where RiskScore >= 50
| order by RiskScore desc

index=endpoint sourcetype=crowdstrike:events:sensor OR sourcetype=sysmon
(process_name="chrome.exe" OR process_name="msedge.exe" OR process_name="brave.exe" OR process_name="chromium.exe")
| eval is_suspicious_child=if(match(child_process_name, "(?i)(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe)"), 1, 0)
| where is_suspicious_child=1
| eval encoded_cmd=if(match(child_process_cmdline, "(?i)(-enc|-EncodedCommand|IEX|Invoke-Expression)"), 1, 0)
| eval risk_score=case(
    encoded_cmd=1, 90,
    match(child_process_name, "(?i)powershell\.exe"), 75,
    match(child_process_name, "(?i)cmd\.exe"), 65,
    true(), 50
  )
| where risk_score >= 50
| stats count as spawn_count, values(child_process_name) as child_procs, values(child_process_cmdline) as cmdlines, max(risk_score) as max_risk by host, user, process_name, process_id, _time
| where spawn_count >= 1
| sort - max_risk
| table _time, host, user, process_name, child_procs, cmdlines, spawn_count, max_risk

sequence by host.name, process.parent.entity_id with maxspan=2m
  [process where process.name in~ ("chrome.exe", "msedge.exe", "brave.exe", "chromium.exe") and event.type == "start"]
  [process where process.parent.name in~ ("chrome.exe", "msedge.exe", "brave.exe", "chromium.exe")
    and process.name in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe")
    and event.type == "start"
  ]
  [any where (
    (event.category == "network" and destination.port in (4444, 1337, 8080, 9001, 31337))
    or
    (event.category == "file" and file.path like "*\\AppData\\Roaming\\*" and file.extension in ("exe", "dll", "ps1", "vbs", "bat"))
  )]

SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') as event_time,
       sourceip,
       username,
       "Process Name" as parent_process,
       "Command" as child_command,
       LOGSOURCENAME(logsourceid) as log_source,
       magnitude
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'CrowdStrike Falcon')
  AND LOWER("Process Name") LIKE ANY ('%chrome.exe%', '%msedge.exe%', '%brave.exe%', '%chromium.exe%')
  AND LOWER("Command") LIKE ANY ('%cmd.exe%', '%powershell.exe%', '%wscript.exe%', '%mshta.exe%', '%rundll32.exe%', '%regsvr32.exe%', '%certutil.exe%')
  AND starttime > NOW() - 7 DAYS
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=endpoint/windows OR _sourceCategory=endpoint/crowdstrike
| where (process matches /(?i)chrome\.exe/ OR process matches /(?i)msedge\.exe/ OR process matches /(?i)brave\.exe/ OR process matches /(?i)chromium\.exe/)
| where (childprocess matches /(?i)cmd\.exe/ OR childprocess matches /(?i)powershell\.exe/ OR childprocess matches /(?i)wscript\.exe/ OR childprocess matches /(?i)cscript\.exe/ OR childprocess matches /(?i)mshta\.exe/ OR childprocess matches /(?i)rundll32\.exe/ OR childprocess matches /(?i)regsvr32\.exe/ OR childprocess matches /(?i)certutil\.exe/)
| count by _sourceHost, user, process, childprocess, commandline
| where _count >= 1
| if(commandline matches /(?i)(-enc|-EncodedCommand|IEX|Invoke-Expression)/, 90, if(childprocess matches /(?i)powershell/, 75, 60)) as risk_score
| where risk_score >= 60
| order by risk_score desc
| fields _sourceHost, user, process, childprocess, commandline, risk_score, _count

rule cve_2025_14174_chromium_oob_exploit {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects potential exploitation of CVE-2025-14174 Chromium OOB memory access via suspicious child process spawning"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-14174"
    yara_version = "YL2.0"
    rule_version = "1.0"

  events:
    $browser.metadata.event_type = "PROCESS_LAUNCH"
    $browser.principal.process.file.full_path = /(?i)(chrome\.exe|msedge\.exe|brave\.exe|chromium\.exe)$/

    $child.metadata.event_type = "PROCESS_LAUNCH"
    $child.principal.process.file.full_path = /(?i)(chrome\.exe|msedge\.exe|brave\.exe|chromium\.exe)$/
    $child.target.process.file.full_path = /(?i)(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe)$/

    $browser.principal.hostname = $child.principal.hostname
    $browser.target.process.pid = $child.principal.process.parent_pid

    $browser.metadata.event_timestamp.seconds < $child.metadata.event_timestamp.seconds
    $child.metadata.event_timestamp.seconds - $browser.metadata.event_timestamp.seconds < 120

  condition:
    $browser and $child
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName in ("chrome.exe", "msedge.exe", "brave.exe", "chromium.exe")
| FileName in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe")
| eval RiskScore = case(
    CommandLine = /(?i)(-enc|-EncodedCommand|IEX|Invoke-Expression)/ AND FileName = "powershell.exe", "90-Critical",
    FileName = "powershell.exe", "75-High",
    FileName = "cmd.exe" AND CommandLine = /\/c\s/i, "65-High",
    true(), "50-Medium"
  )
| where RiskScore != ""
| table _time, ComputerName, UserName, ParentBaseFileName, ParentProcessId, FileName, CommandLine, RiskScore
| sort - RiskScore
| limit 200