Detect Drive-by Compromise in CrowdStrike LogScale
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Drive-by compromise occurs when exploit code is delivered through a browser, often via a compromised legitimate website (watering hole), malicious advertising (malvertising), or injected iframes/scripts. Upon visiting the malicious page, browser or plugin exploits execute code silently, commonly resulting in the browser spawning unexpected child processes, writing executables to disk, or making unusual outbound network connections that establish C2 channels. This technique is particularly dangerous because it requires no user interaction beyond visiting a page and is frequently used for targeted attacks against specific communities or industries.
MITRE ATT&CK
- Tactic
- Initial Access
- Technique
- T1189 Drive-by Compromise
- Canonical reference
- https://attack.mitre.org/techniques/T1189/
LogScale Detection Query
// Branch 1: Browser spawning suspicious child process
#event_simpleName=ProcessRollup2
| ParentBaseFileName = /(?i)^(chrome|firefox|msedge|microsoftedge|iexplore|opera|brave|MicrosoftEdge)\.exe$/
| ImageFileName = /(?i)\\(powershell|cmd|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|wmic|msiexec|schtasks|at|net|netsh|sc|reg|bash|sh|curl|wget)\.exe$/
| DetectionType := "BrowserSpawnedSuspiciousChild"
| RiskIndicator := format("Parent=%s spawned=%s", field="ParentBaseFileName", field="ImageFileName")
| table([_time, ComputerName, UserName, DetectionType, RiskIndicator, ImageFileName, CommandLine, ParentBaseFileName, ParentCommandLine])
// Branch 2: Browser writing executable to disk (use SyntheticProcessRollup2 + file write events)
| union (
#event_simpleName=SyntheticProcessRollup2
| ContextBaseFileName = /(?i)^(chrome|firefox|msedge|microsoftedge|iexplore|opera|brave|MicrosoftEdge)\.exe$/
| TargetFileName = /(?i)\.(exe|dll|bat|ps1|vbs|js|hta|scr|pif|com)$/
| TargetFileName = /(?i)(\\Temp\\|\\AppData\\|\\Downloads\\|\\Public\\|\\ProgramData\\)/
| TargetFileName != /(?i)(\\Chrome\\|\\Firefox\\|\\Edge\\|Cache|Update|CrashReport)/
| DetectionType := "BrowserWroteExecutableToDisk"
| RiskIndicator := format("Browser=%s wrote=%s", field="ContextBaseFileName", field="TargetFileName")
| CommandLine := ""
| ParentBaseFileName := ""
| ParentCommandLine := ""
| table([_time, ComputerName, UserName, DetectionType, RiskIndicator, ContextBaseFileName, CommandLine, ParentBaseFileName, ParentCommandLine, TargetFileName])
)
| sort(field=_time, order=desc)Detects drive-by compromise using CrowdStrike Falcon telemetry. Branch 1 queries ProcessRollup2 events for browser processes (Chrome, Firefox, Edge, IE, Opera, Brave) that spawn LOLBins or scripting engines as direct children. Branch 2 queries SyntheticProcessRollup2 file-write events where a browser drops executable or script payloads into user-writable paths (Temp, AppData, Downloads, Public, ProgramData) while excluding legitimate browser update/cache directories.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate software distribution via browser portals where an enterprise deployment tool (e.g., PDQ Deploy web console, JAMF Self Service) causes the browser to download and execute signed MSI packages via msiexec.exe
- Developer machines running browser-based build orchestration (e.g., GitHub Actions local runner triggered from a web UI) that legitimately spawns powershell.exe or cmd.exe for build tasks
- PDF or Office plugin installers delivered via browser that extract helper executables to AppData during first-run initialization, such as Adobe Acrobat Reader DC updates triggered from within the browser
Other platforms for T1189
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Browser Spawning cmd.exe (Drive-by Code Execution Indicator)
Expected signal: Sysmon Event ID 1: Process Create with Image=cmd.exe, ParentImage=chrome.exe (or reflected PID). Security Event ID 4688 if process auditing enabled. The parent-child relationship in the process tree should show chrome.exe -> cmd.exe -> whoami.exe.
- Test 2Browser Writing Executable to Temp Directory
Expected signal: Sysmon Event ID 11: File Create with TargetFilename=%TEMP%\update_helper.exe. The initiating process will be powershell.exe in this test (in a real scenario it would be chrome.exe or similar). File creation timestamp and SHA256 hash will be logged.
- Test 3Malvertising Redirect Chain DNS Lookup Pattern
Expected signal: Sysmon Event ID 22: DNS Query for each of the five test domains, all initiated by cmd.exe within seconds of each other. Windows DNS Client Event Log will also record these queries. All queries will return NXDOMAIN as the domains do not exist.
- Test 4Browser Push Notification Abuse Simulation — Malicious Script via Notification Click
Expected signal: Sysmon Event ID 1: powershell.exe process created with -WindowStyle Hidden and Invoke-WebRequest in command line. Sysmon Event ID 3: network connection attempt to 127.0.0.1:9999 (will fail with no listener, but connection attempt is logged). PowerShell ScriptBlock Log Event ID 4104 capturing the download cradle command.
References (10)
- https://attack.mitre.org/techniques/T1189/
- http://blog.shadowserver.org/2012/05/15/cyber-espionage-strategic-web-compromises-trusted-websites-serving-dangerous-results/
- https://www.malwarebytes.com/blog/news/2019/01/browser-push-notifications-feature-asking-abused
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicefileevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicenetworkevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1189/T1189.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
- https://www.mandiant.com/resources/blog/watering-hole-attacks-overview
- https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage
Unlock Pro Content
Get the full detection package for T1189 including response playbook, investigation guide, and atomic red team tests.