Detect Drive-by Compromise in Elastic Security
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Drive-by compromise occurs when exploit code is delivered through a browser, often via a compromised legitimate website (watering hole), malicious advertising (malvertising), or injected iframes/scripts. Upon visiting the malicious page, browser or plugin exploits execute code silently, commonly resulting in the browser spawning unexpected child processes, writing executables to disk, or making unusual outbound network connections that establish C2 channels. This technique is particularly dangerous because it requires no user interaction beyond visiting a page and is frequently used for targeted attacks against specific communities or industries.
MITRE ATT&CK
- Tactic
- Initial Access
- Technique
- T1189 Drive-by Compromise
- Canonical reference
- https://attack.mitre.org/techniques/T1189/
Elastic Detection Query
sequence by host.id with maxspan=5m
[
any where event.category == "process" and event.type == "start"
and process.parent.name in~ ("chrome.exe", "firefox.exe", "msedge.exe", "microsoftedge.exe", "iexplore.exe", "opera.exe", "brave.exe", "MicrosoftEdge.exe")
and process.name in~ ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "wmic.exe", "msiexec.exe", "schtasks.exe", "at.exe", "net.exe", "netsh.exe", "sc.exe", "reg.exe", "bash.exe", "sh.exe", "curl.exe", "wget.exe")
]
union
sequence by host.id with maxspan=5m
[
any where event.category == "file" and event.type in ("creation", "change")
and process.name in~ ("chrome.exe", "firefox.exe", "msedge.exe", "microsoftedge.exe", "iexplore.exe", "opera.exe", "brave.exe", "MicrosoftEdge.exe")
and file.extension in~ ("exe", "dll", "bat", "ps1", "vbs", "js", "hta", "scr", "pif", "com")
and (
file.path like~ "*\\Temp\\*" or
file.path like~ "*\\AppData\\Local\\Temp\\*" or
file.path like~ "*\\Downloads\\*" or
file.path like~ "*\\AppData\\Roaming\\*" or
file.path like~ "*\\Public\\*" or
file.path like~ "*\\ProgramData\\*"
)
and not (
file.path like~ "*\\Chrome\\*" or
file.path like~ "*\\Firefox\\*" or
file.path like~ "*\\Edge\\*" or
file.path like~ "*Cache*" or
file.path like~ "*Update*" or
file.path like~ "*CrashReport*"
)
]Detects drive-by compromise indicators: browsers spawning suspicious child processes (LOLBins, scripting engines) or writing executable/script files to writable user directories. Covers both the initial code execution stage and the payload staging stage of a drive-by attack.
Data Sources
Required Tables
False Positives & Tuning
- Browser-integrated download managers or update helpers (e.g., Chrome Updater, Firefox Maintenance Service) that legitimately write executables to temp directories during auto-update cycles
- Legitimate developer workflows where a browser-based IDE or test runner (e.g., VS Code Live Share, JupyterLab) spawns cmd.exe or powershell.exe to run build commands
- Enterprise web portals that use browser-launched ClickOnce installers or ActiveX controls, resulting in msiexec.exe being spawned by Internet Explorer or Edge
Other platforms for T1189
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Browser Spawning cmd.exe (Drive-by Code Execution Indicator)
Expected signal: Sysmon Event ID 1: Process Create with Image=cmd.exe, ParentImage=chrome.exe (or reflected PID). Security Event ID 4688 if process auditing enabled. The parent-child relationship in the process tree should show chrome.exe -> cmd.exe -> whoami.exe.
- Test 2Browser Writing Executable to Temp Directory
Expected signal: Sysmon Event ID 11: File Create with TargetFilename=%TEMP%\update_helper.exe. The initiating process will be powershell.exe in this test (in a real scenario it would be chrome.exe or similar). File creation timestamp and SHA256 hash will be logged.
- Test 3Malvertising Redirect Chain DNS Lookup Pattern
Expected signal: Sysmon Event ID 22: DNS Query for each of the five test domains, all initiated by cmd.exe within seconds of each other. Windows DNS Client Event Log will also record these queries. All queries will return NXDOMAIN as the domains do not exist.
- Test 4Browser Push Notification Abuse Simulation — Malicious Script via Notification Click
Expected signal: Sysmon Event ID 1: powershell.exe process created with -WindowStyle Hidden and Invoke-WebRequest in command line. Sysmon Event ID 3: network connection attempt to 127.0.0.1:9999 (will fail with no listener, but connection attempt is logged). PowerShell ScriptBlock Log Event ID 4104 capturing the download cradle command.
References (10)
- https://attack.mitre.org/techniques/T1189/
- http://blog.shadowserver.org/2012/05/15/cyber-espionage-strategic-web-compromises-trusted-websites-serving-dangerous-results/
- https://www.malwarebytes.com/blog/news/2019/01/browser-push-notifications-feature-asking-abused
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicefileevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicenetworkevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1189/T1189.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
- https://www.mandiant.com/resources/blog/watering-hole-attacks-overview
- https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage
Unlock Pro Content
Get the full detection package for T1189 including response playbook, investigation guide, and atomic red team tests.