Detection rules › Splunk

Windows Chrome Auto-Update Disabled via Registry

Author
Teoderick Contreras, Splunk
Source
upstream

The following analytic detects modifications to Windows registry values that disable Google Chrome auto-updates. Changes to values such as DisableAutoUpdateChecksCheckboxValue = 1, Update{8A69D345-D564-463C-AFF1-A69D9E530F96} = 0, UpdateDefault = 0, and AutoUpdateCheckPeriodMinutes = 0 can prevent Chrome from receiving security updates. This behavior may indicate attempts to bypass update policies, maintain unauthorized extensions, or facilitate malware persistence. Monitoring these registry changes helps identify potential policy violations or malicious activity targeting browser security.

MITRE ATT&CK coverage

TacticTechniques
CollectionT1185 Browser Session Hijacking

Event coverage

ProviderEvent IDTitle
Sysmon13RegistryEvent (Value Set)

Stages and Predicates

Stage 1: tstats

tstats WHERE ((Registry.registry_path="*\\Google\\Update*" Registry.registry_value_data=0x00000001 Registry.registry_value_name="DisableAutoUpdateChecksCheckboxValue") OR (Registry.registry_value_data=0x00000000 Registry.registry_value_name IN ("AutoUpdateCheckPeriodMinutes", "UpdateDefault", "Update{8A69D345-D564-463C-AFF1-A69D9E530F96}"))) BY Registry.action, Registry.dest, Registry.process_guid, Registry.process_id, Registry.registry_hive, Registry.registry_path, Registry.registry_key_name, Registry.registry_value_data, Registry.registry_value_name, Registry.registry_value_type, Registry.status, Registry.user, Registry.vendor_product

Stage 2: search

search

Stage 3: search

search

Stage 4: search

search

Stage 5: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Registry.registry_patheq
  • "*\\Google\\Update*"
Registry.registry_value_dataeq
  • 0x00000000 corpus 8 (splunk 8)
  • 0x00000001 corpus 12 (splunk 12)
Registry.registry_value_nameeq
  • "DisableAutoUpdateChecksCheckboxValue"
Registry.registry_value_namein
  • "AutoUpdateCheckPeriodMinutes"
  • "UpdateDefault"
  • "Update{8A69D345-D564-463C-AFF1-A69D9E530F96}"