Detect Drive-by Compromise in Microsoft Sentinel
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Drive-by compromise occurs when exploit code is delivered through a browser, often via a compromised legitimate website (watering hole), malicious advertising (malvertising), or injected iframes/scripts. Upon visiting the malicious page, browser or plugin exploits execute code silently, commonly resulting in the browser spawning unexpected child processes, writing executables to disk, or making unusual outbound network connections that establish C2 channels. This technique is particularly dangerous because it requires no user interaction beyond visiting a page and is frequently used for targeted attacks against specific communities or industries.
MITRE ATT&CK
- Tactic
- Initial Access
- Technique
- T1189 Drive-by Compromise
- Canonical reference
- https://attack.mitre.org/techniques/T1189/
KQL Detection Query
let BrowserProcesses = dynamic(["chrome.exe", "firefox.exe", "msedge.exe", "microsoftedge.exe", "iexplore.exe", "opera.exe", "brave.exe", "MicrosoftEdge.exe"]);
let SuspiciousChildProcesses = dynamic([
"powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe",
"rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe",
"wmic.exe", "msiexec.exe", "schtasks.exe", "at.exe",
"net.exe", "netsh.exe", "sc.exe", "reg.exe",
"bash.exe", "sh.exe", "curl.exe", "wget.exe"
]);
let SuspiciousExtensions = dynamic([".exe", ".dll", ".bat", ".ps1", ".vbs", ".js", ".hta", ".scr", ".pif", ".com"]);
// Branch 1: Browser spawning suspicious child processes (primary indicator)
let BrowserChildProc = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ (BrowserProcesses)
| where FileName in~ (SuspiciousChildProcesses)
| extend DetectionType = "BrowserSpawnedSuspiciousChild"
| extend RiskIndicator = strcat("Browser:", InitiatingProcessFileName, " spawned:", FileName);
// Branch 2: Browser writing executables or scripts to disk
let BrowserFileWrite = DeviceFileEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ (BrowserProcesses)
| where FileName has_any (SuspiciousExtensions)
| where FolderPath has_any ("\\Temp\\", "\\AppData\\Local\\Temp\\", "\\Downloads\\", "\\AppData\\Roaming\\", "\\Public\\", "\\ProgramData\\")
| where not (FolderPath has_any ("\\Chrome\\", "\\Firefox\\", "\\Edge\\", "\\CrashReports\\", "\\Cache\\", "\\Update\\"))
| extend DetectionType = "BrowserWroteExecutableToDisk"
| extend RiskIndicator = strcat("Browser:", InitiatingProcessFileName, " wrote:", FileName, " to:", FolderPath);
// Branch 1 output
BrowserChildProc
| project Timestamp, DeviceName, AccountName, DetectionType, RiskIndicator,
FileName, ProcessCommandLine, InitiatingProcessFileName,
InitiatingProcessCommandLine, InitiatingProcessParentFileName
| union (
BrowserFileWrite
| project Timestamp, DeviceName, AccountName, DetectionType, RiskIndicator,
FileName, ProcessCommandLine = "", InitiatingProcessFileName,
InitiatingProcessCommandLine, InitiatingProcessParentFileName
)
| sort by Timestamp descDetects drive-by compromise indicators by monitoring browser processes (Chrome, Firefox, Edge, IE, Opera, Brave) for two high-fidelity signals: (1) spawning suspicious child processes like cmd.exe, powershell.exe, wscript.exe, mshta.exe, certutil.exe, or regsvr32.exe — which is the primary post-exploitation indicator when a browser exploit achieves code execution; and (2) browsers writing executable file types (.exe, .dll, .ps1, .vbs, .hta, .bat) to writable directories outside normal browser cache/update paths. Uses DeviceProcessEvents and DeviceFileEvents tables from Microsoft Defender for Endpoint.
Data Sources
Required Tables
False Positives & Tuning
- Browser-based development tools (VS Code in browser, Jupyter) that legitimately spawn shell processes or write scripts to disk
- Software update mechanisms where browser update components (GoogleUpdate.exe, MicrosoftEdgeUpdate.exe) write update executables — distinguish by parent process and folder path
- Enterprise web applications that use browser-initiated file downloads as part of legitimate workflows (e.g., downloading batch scripts from internal portals)
- Penetration testing tools and red team frameworks that use browsers as delivery mechanisms in authorized engagements
- Browser extensions with broad file system permissions writing helper applications or native messaging hosts
Other platforms for T1189
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Browser Spawning cmd.exe (Drive-by Code Execution Indicator)
Expected signal: Sysmon Event ID 1: Process Create with Image=cmd.exe, ParentImage=chrome.exe (or reflected PID). Security Event ID 4688 if process auditing enabled. The parent-child relationship in the process tree should show chrome.exe -> cmd.exe -> whoami.exe.
- Test 2Browser Writing Executable to Temp Directory
Expected signal: Sysmon Event ID 11: File Create with TargetFilename=%TEMP%\update_helper.exe. The initiating process will be powershell.exe in this test (in a real scenario it would be chrome.exe or similar). File creation timestamp and SHA256 hash will be logged.
- Test 3Malvertising Redirect Chain DNS Lookup Pattern
Expected signal: Sysmon Event ID 22: DNS Query for each of the five test domains, all initiated by cmd.exe within seconds of each other. Windows DNS Client Event Log will also record these queries. All queries will return NXDOMAIN as the domains do not exist.
- Test 4Browser Push Notification Abuse Simulation — Malicious Script via Notification Click
Expected signal: Sysmon Event ID 1: powershell.exe process created with -WindowStyle Hidden and Invoke-WebRequest in command line. Sysmon Event ID 3: network connection attempt to 127.0.0.1:9999 (will fail with no listener, but connection attempt is logged). PowerShell ScriptBlock Log Event ID 4104 capturing the download cradle command.
References (10)
- https://attack.mitre.org/techniques/T1189/
- http://blog.shadowserver.org/2012/05/15/cyber-espionage-strategic-web-compromises-trusted-websites-serving-dangerous-results/
- https://www.malwarebytes.com/blog/news/2019/01/browser-push-notifications-feature-asking-abused
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicefileevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicenetworkevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1189/T1189.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
- https://www.mandiant.com/resources/blog/watering-hole-attacks-overview
- https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage
Unlock Pro Content
Get the full detection package for T1189 including response playbook, investigation guide, and atomic red team tests.