Detection: Windows Content Copied from Browser was Executed

 1`sysmon`
 2EventID IN (13, 24)
 3(
 4    registry_key_name=*RunMRU*
 5    OR
 6    process_name IN (
 7    "360se.exe", "arc.exe", "atlas.exe", "avastbrowser.exe", "avgbrowser.exe", "blpbrowser.exe", "brave.exe", "braveupdate.exe",
 8    "chrome.exe", "chromium.exe", "coccoc.exe", "dragon.exe", "duckduckgo.exe", "epic.exe", "firefox.exe", "ghost.exe",
 9    "iexplore.exe", "iridium.exe", "iron.exe", "maxthon.exe", "microsoftedge.exe", "microsoftedgeupdate.exe", "msedge.exe",
10    "msedgewebview2.exe", "opera.exe", "opera_autoupdate.exe", "perplexity.exe", "rave.exe", "safari.exe", "shift.exe",
11    "sidekick.exe", "thorium.exe", "torch.exe", "vivaldi.exe", "wavebrowser.exe", "whale.exe", "zen.exe"
12    )
13)
14
15| eval trimmed_command = rtrim(registry_value_data, "\1")
16
17| eval utf16le_command = urldecode(replace(trimmed_command, "(.)", "\1%00"))
18
19| eval sha256_process=upper(sha256(utf16le_command))
20
21| eval hash_command=coalesce(SHA256,sha256_process)
22
23| stats min(_time) as firstTime max(_time) as lastTime values(process_name) as process_name
24    values(trimmed_command) as process values(EventID) as EventID dc(EventID) as dc_EventID count
25    by hash_command dest user
26
27| search dc_EventID>1
28
29| eval process_name = mvfilter(
30    process_name IN (
31    "360se.exe", "arc.exe", "atlas.exe", "avastbrowser.exe", "avgbrowser.exe", "blpbrowser.exe", "brave.exe", "braveupdate.exe",
32    "chrome.exe", "chromium.exe", "coccoc.exe", "dragon.exe", "duckduckgo.exe", "epic.exe", "firefox.exe", "ghost.exe",
33    "iexplore.exe", "iridium.exe", "iron.exe", "maxthon.exe", "microsoftedge.exe", "microsoftedgeupdate.exe", "msedge.exe",
34    "msedgewebview2.exe", "opera.exe", "opera_autoupdate.exe", "perplexity.exe", "rave.exe", "safari.exe", "shift.exe",
35    "sidekick.exe", "thorium.exe", "torch.exe", "vivaldi.exe", "wavebrowser.exe", "whale.exe", "zen.exe"
36    )
37  )
38
39| `security_content_ctime(firstTime)`
40
41| `security_content_ctime(lastTime)`
42
43| `windows_content_copied_from_browser_was_executed_filter`