Sigma rule: Running Chrome VPN Extensions via the Registry 2 VPN Extension

Rule

Title

Running Chrome VPN Extensions via the Registry 2 VPN Extension

Status

test

Level

high

Author

frack113

Date

2021-12-28

Modified

2023-08-17

File

rules/windows/registry/registry_set/registry_set_chrome_extension.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Running Chrome VPN Extensions via the Registry install 2 vpn extension

Log source

product

windows

category

registry_set

Detection

chrome_ext:
    TargetObject|contains: 'Software\Wow6432Node\Google\Chrome\Extensions'
    TargetObject|endswith: 'update_url'
chrome_vpn:
    TargetObject|contains:
        - fdcgdnkidjaadafnichfpabhfomcebme # ZenMate VPN
        - fcfhplploccackoneaefokcmbjfbkenj # 1clickVPN
        - bihmplhobchoageeokmgbdihknkjbknd # Touch VPN
        - gkojfkhlekighikafcpjkiklfbnlmeio # Hola Free VPN
        - jajilbjjinjmgcibalaakngmkilboobh # Astar VPN
        - gjknjjomckknofjidppipffbpoekiipm # VPN Free
        - nabbmpekekjknlbkgpodfndbodhijjem # Earth VPN
        - kpiecbcckbofpmkkkdibbllpinceiihk # DotVPN
        - nlbejmccbhkncgokjcmghpfloaajcffj # Hotspot Shield Free VPN
        - omghfjlpggmjjaagoclmmobgdodcjboh # Browsec VPN
        - bibjcjfmgapbfoljiojpipaooddpkpai # VPN-free.pro
        - mpcaainmfjjigeicjnlkdfajbioopjko # VPN Unlimited Free
        - jljopmgdobloagejpohpldgkiellmfnc # PP VPN
        - lochiccbgeohimldjooaakjllnafhaid # IP Unblock
        - nhnfcgpcbfclhfafjlooihdfghaeinfc # Surf VPN
        - ookhnhpkphagefgdiemllfajmkdkcaim # iNinja VPN
        - namfblliamklmeodpcelkokjbffgmeoo # Daily VPN
        - nbcojefnccbanplpoffopkoepjmhgdgh # Hoxx VPN Proxy
        - majdfhpaihoncoakbjgbdhglocklcgno # Free VPN
        - lnfdmdhmfbimhhpaeocncdlhiodoblbd # VPN PROXY MASTER
        - eppiocemhmnlbhjplcgkofciiegomcon # Urban Free VPN
        - cocfojppfigjeefejbpfmedgjbpchcng # SaferVPN Proxy
        - foiopecknacmiihiocgdjgbjokkpkohc # VPN Professional
        - hhdobjgopfphlmjbmnpglhfcgppchgje # AdGuard VPN
        - jgbaghohigdbgbolncodkdlpenhcmcge # Free VPN
        - inligpkjkhbpifecbdjhmdpcfhnlelja # Free One Touch VPN
        - higioemojdadgdbhbbbkfbebbdlfjbip # Unlimited VPN & Proxy by ibVPN
        - hipncndjamdcmphkgngojegjblibadbe # RusVPN
        - iolonopooapdagdemdoaihahlfkncfgg # Azino VPN
        - nhfjkakglbnnpkpldhjmpmmfefifedcj # Pron VPN
        - jpgljfpmoofbmlieejglhonfofmahini # Free Residential VPN
        - fgddmllnllkalaagkghckoinaemmogpe # ExpressVPN
        - ejkaocphofnobjdedneohbbiilggdlbi # Hotspot Shield Elite VPN Proxy
        - keodbianoliadkoelloecbhllnpiocoi # Hide My IP VPN
        - hoapmlpnmpaehilehggglehfdlnoegck # Tunnello VPN
        - poeojclicodamonabcabmapamjkkmnnk # HMA VPN Proxy Unblocker
        - dfkdflfgjdajbhocmfjolpjbebdkcjog # Free Avira Phantom VPN
        - kcdahmgmaagjhocpipbodaokikjkampi # Hola VPN
        - klnkiajpmpkkkgpgbogmcgfjhdoljacg # Free VPN for Chrome
        - lneaocagcijjdpkcabeanfpdbmapcjjg # Hub VPN
        - pgfpignfckbloagkfnamnolkeaecfgfh # Free Proxy VPN
        - jplnlifepflhkbkgonidnobkakhmpnmh # Private Internet Access
        - jliodmnojccaloajphkingdnpljdhdok # Turbo VPN for PC
        - hnmpcagpplmpfojmgmnngilcnanddlhb # Windscribe
        - ffbkglfijbcbgblgflchnbphjdllaogb # CyberGhost VPN
        - kcndmbbelllkmioekdagahekgimemejo # VPN.AC
        - jdgilggpfmjpbodmhndmhojklgfdlhob # Browser VPN
        - bihhflimonbpcfagfadcnbbdngpopnjb # DEEPRISM VPN
        - ppajinakbfocjfnijggfndbdmjggcmde # My Browser Vpn
        - oofgbpoabipfcfjapgnbbjjaenockbdp # SetupVPN
        - bhnhkdgoefpmekcgnccpnhjfdgicfebm # Wachee VPN
        - knmmpciebaoojcpjjoeonlcjacjopcpf # Thunder Proxy
        - dhadilbmmjiooceioladdphemaliiobo # Free Proxy VPN
        - jedieiamjmoflcknjdjhpieklepfglin # FastestVPN Proxy
        - mhngpdlhojliikfknhfaglpnddniijfh # WorkingVPN
        - omdakjcmkglenbhjadbccaookpfjihpa # TunnelBear VPN
        - npgimkapccfidfkfoklhpkgmhgfejhbj # BelkaVPN
        - akeehkgglkmpapdnanoochpfmeghfdln # VPN Master
        - gbmdmipapolaohpinhblmcnpmmlgfgje # Unblock Websites
        - aigmfoeogfnljhnofglledbhhfegannp # Lethean Proxy VPN
        - cgojmfochfikphincbhokimmmjenhhgk # Whoer VPN
        - ficajfeojakddincjafebjmfiefcmanc # Best VPN USA
        - ifnaibldjfdmaipaddffmgcmekjhiloa # FREE VPN DEWELOPMENT
        - jbnmpdkcfkochpanomnkhnafobppmccn # apkfold free vpn
        - apcfdffemoinopelidncddjbhkiblecc # Soul VPN
        - mjolnodfokkkaichkcjipfgblbfgojpa # DotVPN
        - oifjbnnafapeiknapihcmpeodaeblbkn # rderzh VPN Proxy
        - plpmggfglncceinmilojdkiijhmajkjh # Red Panda VPN
        - mjnbclmflcpookeapghfhapeffmpodij # Ultrareach VPN
        - bblcccknbdbplgmdjnnikffefhdlobhp # FastStunnel VPN
        - aojlhgbkmkahabcmcpifbolnoichfeep # VirtualShield VPN
        - lcmammnjlbmlbcaniggmlejfjpjagiia # Adblock Office VPN Proxy Server
        - knajdeaocbpmfghhmijicidfcmdgbdpm # Guru VPN & Proxy
        - bdlcnpceagnkjnjlbbbcepohejbheilk # Malus VPN
        - edknjdjielmpdlnllkdmaghlbpnmjmgb # Muscle VPN
        - eidnihaadmmancegllknfbliaijfmkgo # Push VPN
        - ckiahbcmlmkpfiijecbpflfahoimklke # Gom VPN
        - macdlemfnignjhclfcfichcdhiomgjjb # Free Fast VPN
        - chioafkonnhbpajpengbalkececleldf # BullVPN
        - amnoibeflfphhplmckdbiajkjaoomgnj # HideAll VPN
        - llbhddikeonkpbhpncnhialfbpnilcnc # ProxyFlow
        - pcienlhnoficegnepejpfiklggkioccm # Cloud VPN
        - iocnglnmfkgfedpcemdflhkchokkfeii # sVPN
        - igahhbkcppaollcjeaaoapkijbnphfhb # Social VPN
        - njpmifchgidinihmijhcfpbdmglecdlb # Trellonet Trellonet
        - ggackgngljinccllcmbgnpgpllcjepgc # WindmillVPN
        - kchocjcihdgkoplngjemhpplmmloanja # IPBurger Proxy & VPN
        - bnijmipndnicefcdbhgcjoognndbgkep # Veee
        - lklekjodgannjcccdlbicoamibgbdnmi # Anonymous Proxy Vpn Browser
        - dbdbnchagbkhknegmhgikkleoogjcfge # Hideman VPN
        - egblhcjfjmbjajhjhpmnlekffgaemgfh # Fornex VPN
        - ehbhfpfdkmhcpaehaooegfdflljcnfec # WeVPN
        - bkkgdjpomdnfemhhkalfkogckjdkcjkg # VPNMatic
        - almalgbpmcfpdaopimbdchdliminoign # Urban Shield
        - akkbkhnikoeojlhiiomohpdnkhbkhieh # Prime VPN
        - gbfgfbopcfokdpkdigfmoeaajfmpkbnh # westwind
        - bniikohfmajhdcffljgfeiklcbgffppl # Upnet
        - lejgfmmlngaigdmmikblappdafcmkndb # uVPN
        - ffhhkmlgedgcliajaedapkdfigdobcif # Nucleus VPN
        - gcknhkkoolaabfmlnjonogaaifnjlfnp # FoxyProxy Standard
        - pooljnboifbodgifngpppfklhifechoe # GeoProxy
        - fjoaledfpmneenckfbpdfhkmimnjocfa # NordVPN
        - aakchaleigkohafkfjfjbblobjifikek # ProxFlow
        - dpplabbmogkhghncfbfdeeokoefdjegm # Proxy SwitchySharp
        - padekgcemlokbadohgkifijomclgjgif # Proxy SwitchyOmega
        - bfidboloedlamgdmenmlbipfnccokknp # PureVPN
condition: all of chrome_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.initial-access
• attack.persistence
• attack.t1133

MITRE ATT&CK ids this rule names

• T1133

References

• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1133/T1133.md#atomic-test-1---running-chrome-vpn-extensions-via-the-registry-2-vpn-extension

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_chrome_extension.yml