Detect Drive-by Compromise in IBM QRadar
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Drive-by compromise occurs when exploit code is delivered through a browser, often via a compromised legitimate website (watering hole), malicious advertising (malvertising), or injected iframes/scripts. Upon visiting the malicious page, browser or plugin exploits execute code silently, commonly resulting in the browser spawning unexpected child processes, writing executables to disk, or making unusual outbound network connections that establish C2 channels. This technique is particularly dangerous because it requires no user interaction beyond visiting a page and is frequently used for targeted attacks against specific communities or industries.
MITRE ATT&CK
- Tactic
- Initial Access
- Technique
- T1189 Drive-by Compromise
- Canonical reference
- https://attack.mitre.org/techniques/T1189/
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
logsourcename(logsourceid) AS log_source,
"username",
QIDNAME(qid) AS event_name,
"sourceip",
"destinationip",
CATEGORYNAME(category) AS event_category,
"ProcessImage" AS child_process,
"ParentProcessImage" AS parent_process,
"CommandLine" AS command_line,
"TargetFilename" AS target_file,
CASE
WHEN LOWER("ProcessImage") MATCHES '.*\\\\(powershell|cmd|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|wmic|msiexec|schtasks|net|netsh|sc|reg|bash|curl|wget)\.exe'
AND LOWER("ParentProcessImage") MATCHES '.*\\\\(chrome|firefox|msedge|microsoftedge|iexplore|opera|brave)\.exe'
THEN 'BrowserSpawnedSuspiciousChild'
WHEN LOWER("ProcessImage") MATCHES '.*\\\\(chrome|firefox|msedge|microsoftedge|iexplore|opera|brave)\.exe'
AND LOWER("TargetFilename") MATCHES '.*\.(exe|dll|bat|ps1|vbs|js|hta|scr|pif|com)'
AND LOWER("TargetFilename") MATCHES '.*(temp|appdata|downloads|public|programdata).*'
THEN 'BrowserWroteExecutableToDisk'
ELSE 'Unknown'
END AS detection_type
FROM events
WHERE
LOGSOURCETYPEID(logsourceid) IN (12, 13, 167, 368)
AND starttime > NOW() - 86400000
AND (
(
LOWER("ParentProcessImage") MATCHES '.*\\\\(chrome|firefox|msedge|microsoftedge|iexplore|opera|brave)\.exe'
AND LOWER("ProcessImage") MATCHES '.*\\\\(powershell|cmd|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|wmic|msiexec|schtasks|net|netsh|sc|reg|bash|curl|wget)\.exe'
)
OR
(
LOWER("ProcessImage") MATCHES '.*\\\\(chrome|firefox|msedge|microsoftedge|iexplore|opera|brave)\.exe'
AND LOWER("TargetFilename") MATCHES '.*\.(exe|dll|bat|ps1|vbs|js|hta|scr|pif|com)'
AND (
LOWER("TargetFilename") MATCHES '.*(\\\\temp\\\\|\\\\appdata\\\\local\\\\temp\\\\|\\\\downloads\\\\|\\\\appdata\\\\roaming\\\\|\\\\public\\\\|\\\\programdata\\\\).*'
)
AND NOT (
LOWER("TargetFilename") MATCHES '.*(\\\\chrome\\\\|\\\\firefox\\\\|\\\\edge\\\\|cache|update|crashreport).*'
)
)
)
ORDER BY starttime DESC
LIMIT 500Detects drive-by compromise by querying QRadar for Windows Sysmon events where browsers spawn suspicious LOLBin child processes (EventID 1) or write executable/script payloads to user-writable directories (EventID 11). LOGSOURCETYPEID 12/13 covers Windows Event Log and Sysmon log sources.
Data Sources
Required Tables
False Positives & Tuning
- Browser-driven CI/CD integrations where a web dashboard (e.g., Jenkins, TeamCity UI) triggers cmd.exe or powershell.exe build steps via the user's browser session
- Enterprise endpoint management portals (e.g., SCCM, BigFix) delivered through a browser that launch msiexec.exe to install approved software packages
- Legitimate browser plugins or helper applications (PDF viewers, media codecs) that extract temporary executables to AppData during installation initiated from the browser
Other platforms for T1189
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Browser Spawning cmd.exe (Drive-by Code Execution Indicator)
Expected signal: Sysmon Event ID 1: Process Create with Image=cmd.exe, ParentImage=chrome.exe (or reflected PID). Security Event ID 4688 if process auditing enabled. The parent-child relationship in the process tree should show chrome.exe -> cmd.exe -> whoami.exe.
- Test 2Browser Writing Executable to Temp Directory
Expected signal: Sysmon Event ID 11: File Create with TargetFilename=%TEMP%\update_helper.exe. The initiating process will be powershell.exe in this test (in a real scenario it would be chrome.exe or similar). File creation timestamp and SHA256 hash will be logged.
- Test 3Malvertising Redirect Chain DNS Lookup Pattern
Expected signal: Sysmon Event ID 22: DNS Query for each of the five test domains, all initiated by cmd.exe within seconds of each other. Windows DNS Client Event Log will also record these queries. All queries will return NXDOMAIN as the domains do not exist.
- Test 4Browser Push Notification Abuse Simulation — Malicious Script via Notification Click
Expected signal: Sysmon Event ID 1: powershell.exe process created with -WindowStyle Hidden and Invoke-WebRequest in command line. Sysmon Event ID 3: network connection attempt to 127.0.0.1:9999 (will fail with no listener, but connection attempt is logged). PowerShell ScriptBlock Log Event ID 4104 capturing the download cradle command.
References (10)
- https://attack.mitre.org/techniques/T1189/
- http://blog.shadowserver.org/2012/05/15/cyber-espionage-strategic-web-compromises-trusted-websites-serving-dangerous-results/
- https://www.malwarebytes.com/blog/news/2019/01/browser-push-notifications-feature-asking-abused
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicefileevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicenetworkevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1189/T1189.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
- https://www.mandiant.com/resources/blog/watering-hole-attacks-overview
- https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage
Unlock Pro Content
Get the full detection package for T1189 including response playbook, investigation guide, and atomic red team tests.