T1189 Splunk · SPL

Detect Drive-by Compromise in Splunk

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Drive-by compromise occurs when exploit code is delivered through a browser, often via a compromised legitimate website (watering hole), malicious advertising (malvertising), or injected iframes/scripts. Upon visiting the malicious page, browser or plugin exploits execute code silently, commonly resulting in the browser spawning unexpected child processes, writing executables to disk, or making unusual outbound network connections that establish C2 channels. This technique is particularly dangerous because it requires no user interaction beyond visiting a page and is frequently used for targeted attacks against specific communities or industries.

MITRE ATT&CK

Tactic
Initial Access
Technique
T1189 Drive-by Compromise
Canonical reference
https://attack.mitre.org/techniques/T1189/

SPL Detection Query

Splunk (SPL)
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
| eval BrowserParent=case(
    match(ParentImage, "(?i)(chrome\.exe|firefox\.exe|msedge\.exe|microsoftedge\.exe|iexplore\.exe|opera\.exe|brave\.exe)"), "true",
    true(), "false"
  )
| eval BrowserSelf=case(
    match(Image, "(?i)(chrome\.exe|firefox\.exe|msedge\.exe|microsoftedge\.exe|iexplore\.exe|opera\.exe|brave\.exe)"), "true",
    true(), "false"
  )
| eval SuspiciousChild=case(
    match(Image, "(?i)(powershell\.exe|cmd\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe|wmic\.exe|msiexec\.exe|schtasks\.exe|net\.exe|netsh\.exe|sc\.exe|reg\.exe|bash\.exe|curl\.exe|wget\.exe)"), "true",
    true(), "false"
  )
(
  (EventCode=1 BrowserParent="true" SuspiciousChild="true")
  OR
  (EventCode=11 BrowserSelf="true"
    (TargetFilename="*.exe" OR TargetFilename="*.dll" OR TargetFilename="*.bat"
     OR TargetFilename="*.ps1" OR TargetFilename="*.vbs" OR TargetFilename="*.js"
     OR TargetFilename="*.hta" OR TargetFilename="*.scr" OR TargetFilename="*.pif")
    (TargetFilename="*\\Temp\\*" OR TargetFilename="*\\AppData\\*"
     OR TargetFilename="*\\Downloads\\*" OR TargetFilename="*\\Public\\*"
     OR TargetFilename="*\\ProgramData\\*")
    NOT (TargetFilename="*\\Chrome\\*" OR TargetFilename="*\\Firefox\\*"
         OR TargetFilename="*\\Edge\\*" OR TargetFilename="*Cache*"
         OR TargetFilename="*Update*" OR TargetFilename="*CrashReport*")
  )
)
| eval DetectionType=case(
    EventCode=1, "BrowserSpawnedSuspiciousChild",
    EventCode=11, "BrowserWroteExecutableToDisk",
    true(), "Unknown"
  )
| eval RiskIndicator=case(
    EventCode=1, "Parent=".ParentImage." spawned=".Image,
    EventCode=11, "Browser=".Image." wrote=".TargetFilename,
    true(), "Unknown"
  )
| table _time, host, User, EventCode, DetectionType, RiskIndicator,
        Image, CommandLine, ParentImage, ParentCommandLine, TargetFilename
| sort - _time
high severity high confidence

Detects drive-by compromise via Sysmon logs using two event types: EventCode=1 (Process Create) to catch browser processes spawning suspicious child processes (powershell.exe, cmd.exe, wscript.exe, mshta.exe, regsvr32.exe, certutil.exe, etc.), and EventCode=11 (File Create) to catch browsers writing executable file types to writable directories outside normal browser cache and update paths. Uses regex pattern matching against known browser process names and suspicious child process names. Results are labelled with DetectionType and RiskIndicator for analyst triage.

Data Sources

Process: Process CreationFile: File CreationSysmon Event ID 1Sysmon Event ID 11

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives & Tuning

  • Browser-based development tools (VS Code in browser, Jupyter) that legitimately spawn shell processes or write scripts to disk
  • Software update mechanisms where browser update components write update executables — distinguish by TargetFilename path and ParentImage
  • Enterprise web applications initiating legitimate file downloads (batch scripts, PowerShell from internal portals) — build allowlist by ParentImage+TargetFilename combination
  • Browser extensions with native messaging hosts writing helper binaries to AppData
  • Authorized penetration testing activities using browser-based delivery
Download portable Sigma rule (.yml)

Other platforms for T1189

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Browser Spawning cmd.exe (Drive-by Code Execution Indicator)

    Expected signal: Sysmon Event ID 1: Process Create with Image=cmd.exe, ParentImage=chrome.exe (or reflected PID). Security Event ID 4688 if process auditing enabled. The parent-child relationship in the process tree should show chrome.exe -> cmd.exe -> whoami.exe.

  2. Test 2Browser Writing Executable to Temp Directory

    Expected signal: Sysmon Event ID 11: File Create with TargetFilename=%TEMP%\update_helper.exe. The initiating process will be powershell.exe in this test (in a real scenario it would be chrome.exe or similar). File creation timestamp and SHA256 hash will be logged.

  3. Test 3Malvertising Redirect Chain DNS Lookup Pattern

    Expected signal: Sysmon Event ID 22: DNS Query for each of the five test domains, all initiated by cmd.exe within seconds of each other. Windows DNS Client Event Log will also record these queries. All queries will return NXDOMAIN as the domains do not exist.

  4. Test 4Browser Push Notification Abuse Simulation — Malicious Script via Notification Click

    Expected signal: Sysmon Event ID 1: powershell.exe process created with -WindowStyle Hidden and Invoke-WebRequest in command line. Sysmon Event ID 3: network connection attempt to 127.0.0.1:9999 (will fail with no listener, but connection attempt is logged). PowerShell ScriptBlock Log Event ID 4104 capturing the download cradle command.

Last updated: 2026-04-18 Research depth: deep
References (10)

Unlock Pro Content

Get the full detection package for T1189 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Related Techniques

T1566.002Spearphishing LinkT1608.004Drive-by TargetT1583.008MalvertisingT1059.001PowerShellT1059.007JavaScriptT1105Ingress Tool TransferT1055Process InjectionT1053.005Scheduled TaskT1204.001Malicious LinkT1027Obfuscated Files or Information

Same Tactic: Initial Access

Popular Detections