Detect a process opening a browser with injection access rights

Siemphony@siemphonyhighT1185unverified

Matches a process handle opened against a browser with access rights that permit writing to the target's memory or creating a thread in it — the "locates a running browser process, opens it with write/inject rights" step that precedes a browser pivot. The mask list is MITRE's AccessMaskSet knob made concrete: full access plus the read/write/operation/create-thread combinations an injector requests. Browsers opening one another are filtered out, because a Chromium browser process opens its own renderer children with full rights continuously and would otherwise be the only thing this rule ever returns. The privilege gain, module load and intranet egress that MITRE correlates around this event are separate log sources and a time window, so they are not represented here. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0507, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* (((TargetImage="*\\chrome.exe" OR TargetImage="*\\msedge.exe" OR TargetImage="*\\firefox.exe" OR TargetImage="*\\brave.exe" OR TargetImage="*\\opera.exe" OR TargetImage="*\\iexplore.exe") AND (GrantedAccess="0x1FFFFF" OR GrantedAccess="0x1F3FFF" OR GrantedAccess="0x1F1FFF" OR GrantedAccess="0x1F0FFF" OR GrantedAccess="0x147A" OR GrantedAccess="0x143A" OR GrantedAccess="0x1438" OR GrantedAccess="0x0C3A")) AND NOT ((SourceImage="*\\chrome.exe" OR SourceImage="*\\msedge.exe" OR SourceImage="*\\firefox.exe" OR SourceImage="*\\brave.exe" OR SourceImage="*\\opera.exe" OR SourceImage="*\\iexplore.exe")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(TargetImage) LIKE "*\\\\chrome.exe" OR TO_LOWER(TargetImage) LIKE "*\\\\msedge.exe" OR TO_LOWER(TargetImage) LIKE "*\\\\firefox.exe" OR TO_LOWER(TargetImage) LIKE "*\\\\brave.exe" OR TO_LOWER(TargetImage) LIKE "*\\\\opera.exe" OR TO_LOWER(TargetImage) LIKE "*\\\\iexplore.exe") AND (TO_LOWER(GrantedAccess) == "0x1fffff" OR TO_LOWER(GrantedAccess) == "0x1f3fff" OR TO_LOWER(GrantedAccess) == "0x1f1fff" OR TO_LOWER(GrantedAccess) == "0x1f0fff" OR TO_LOWER(GrantedAccess) == "0x147a" OR TO_LOWER(GrantedAccess) == "0x143a" OR TO_LOWER(GrantedAccess) == "0x1438" OR TO_LOWER(GrantedAccess) == "0x0c3a")) AND NOT ((TO_LOWER(process.executable) LIKE "*\\\\chrome.exe" OR TO_LOWER(process.executable) LIKE "*\\\\msedge.exe" OR TO_LOWER(process.executable) LIKE "*\\\\firefox.exe" OR TO_LOWER(process.executable) LIKE "*\\\\brave.exe" OR TO_LOWER(process.executable) LIKE "*\\\\opera.exe" OR TO_LOWER(process.executable) LIKE "*\\\\iexplore.exe")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_access,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetImage" type="pcre2">(?i)(\\chrome\.exe$|\\msedge\.exe$|\\firefox\.exe$|\\brave\.exe$|\\opera\.exe$|\\iexplore\.exe$)</field>    <field name="GrantedAccess" type="pcre2">(?i)(^0x1FFFFF$|^0x1F3FFF$|^0x1F1FFF$|^0x1F0FFF$|^0x147A$|^0x143A$|^0x1438$|^0x0C3A$)</field>    <field name="SourceImage" negate="yes" type="pcre2">(?i)(\\chrome\.exe$|\\msedge\.exe$|\\firefox\.exe$|\\brave\.exe$|\\opera\.exe$|\\iexplore\.exe$)</field>    <description>Detect a process opening a browser with injection access rights</description>    <mitre>      <id>T1185</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"category":"process_access","product":"windows"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: process_access / windows
Level: high
Category: browser_credential_theft
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 8869740e-ce8e-454e-9605-f3e0568397c8

ATT&CKT1185

T1185Browser Session Hijacking

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonbrowser credential theft

browser credential theftAI draft — unreviewed

01 · What this rule detects

One Sysmon EventID 10 record: a process opened a handle to a running browser with access rights that would let it write into that browser's memory or start a thread inside it. That is one step out of MITRE's AN1398 — "locates a running browser process, opens it with write/inject rights, and modifies it" — and the rule stops there. The privilege gain (Security 4672), module load (Sysmon 7) and intranet egress (Sysmon 3) AN1398 correlates around it live in other log sources joined by a TimeWindow, and Sigma expresses no join. The rule's description says so, which is the right habit.

02 · Telemetry you need

category: process_access, product: windows — Sysmon EventID 10, copied
Check your Sysmon config before believing a quiet result. ProcessAccess is
Only three backends render it. translations.json records the Sentinel

03 · How the logic works

selection_browser matches TargetImage|endswith against six browser leaf names. selection_access matches GrantedAccess against eight literal hex values. filter_browser_to_browser removes events where SourceImage|endswith is one of the same six names, because a Chromium browser opens its own renderer children with full rights continuously and would otherwise be all this rule ever returned. Two things about GrantedAccess. First, it is an exact-value list, not a bitmask test — Sigma has no bitwise operator, so every backend renders GrantedAccess == "0x1FFFFF" and friends. An injector requesting exactly the bits it needs (PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_CREATE_THREAD = 0x2A, or 0x1428) performs AN1398's behaviour precisely and matches nothing. 0x1FFFFF (PROCESS_ALL_ACCESS) carries the rule, because asking for everything is still the lazy default. Second, '0x0C3A' is written with a leading zero. Sysmon prints GrantedAccess unpadded — 0xC3A — and these are anchored equality matches in all three rendered backends, so that entry can never fire. Case is handled everywhere; width is not. Attribution: MITRE's AccessMaskSet knob names the idea — "access rights implying injection (e.g., 0x1FFFFF, 0x1F3FF, VM_WRITE, VM_OPERATION, CREATE_THREAD)". The eight concrete values are the author's, who repaired MITRE's typo'd 0x1F3FF to the real 0x1F3FFF rather than copy it into a live query. BrowserList, SignerAllowList, ParentAllowList, InternalCIDR, UserContext and TimeWindow are MITRE's names; every value under them is the author's.

04 · Common false positives

The filter that controls the noise is also the cheapest bypass. SourceImage|endswith: '\chrome.exe' excludes any file named chrome.exe anywhere on disk. copy loader.exe %TEMP%\chrome.exe makes an injector permanently invisible to a level: high rule. The pattern to learn: a noise filter written on a leaf name is an allowlist an attacker joins by renaming a file. The Wazuh rendering — negate="yes" over (?i)(\\chrome\.exe$|…) — shows it has nothing to do with where the file lives.
Beyond that: EDR, anti-malware and DLP agents open every process on the host and will dominate the volume. The rule's four false-positive entries cover those, plus automation drivers, debuggers and backup agents — but the highest-volume benign source against a browser target is missing from all four: WerFault.exe, Windows Error Reporting, opening a hung or crashed browser to take a dump. Browsers crash daily. taskmgr.exe is the same shape.
Also: four of the eight masks (0x1F0FFF, 0x1F1FFF, 0x1F3FFF, 0x1FFFFF) include PROCESS_VM_READ, so a commodity infostealer reading Chrome's memory for cookies matches identically to a session hijacker. That is T1555.003, not T1185, and it is the more common of the two.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0507 and never executed against a log line. level: high is an estimate, and given the rename bypass it is a confident label on an evadable query.
tier_2: means running it: confirm your Sysmon config actually emits ProcessAccess for browser targets, measure what fraction of hits are EDR and WerFault, and check whether 0xC3A appears in your data at all.
tier_3: means restoring MITRE's chain — 4672 privilege gain, then this handle open, then a Sysmon 8 remote thread, inside TimeWindow.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Rewrite the filter on full installed paths
Fix '0x0C3A' to '0xC3A', then check every remaining value against real
Add WerFault.exe and taskmgr.exe by full path — day-one exclusions. Use
To separate a hijack from a cookie stealer you need the Sysmon 8

Declared by the author

Endpoint security agents. EDR, anti-malware and DLP products open every process on the host, browsers included, with full access rights. They are the dominant source of this event and must be excluded by SourceImage before the rule is deployed — MITRE's SignerAllowList knob is the same idea applied to the module-load side of the strategy.
Browser automation and support tooling. Selenium and Playwright drivers, accessibility software, password managers with a native host, and crash-reporting helpers legitimately open browser processes with VM_READ and thread rights; MITRE's ParentAllowList knob names exactly this class of tool.
Debuggers and profilers attached to a browser during application testing, which request full access by design. Scope with the UserContext knob so the rule watches admin workstations and servers where nobody should be automating a browser, rather than developer endpoints.
Backup, forensics and memory-acquisition agents that enumerate and open all running processes on a schedule, producing a burst of matches at the same time each day.

Noise check0 of 1 fired

The baseline holds exactly one ordinary behaviour for this log type, and the rule does not fire on it. One event is close to no evidence: this says the rule is not caught by that one behaviour, and nothing more.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1185, evaluated against their process_access events.

Share this rule

/u/siemphony/8869740e-ce8e-454e-9605-f3e0568397c8

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Detect a process opening a browser with injection access rights

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Sentinel · KQL

Community

Verdicts from engineers who deployed it