T1189 — Drive-by Compromise

Tactic: Initial Access · Platforms: Identity Provider, Linux, macOS, Windows

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including: * A legitimate website is compromised, allowing adversaries to inject malicious code *…

Sigma detection rules (4)

T1189 Drive-by Compromise

title: T1189 Drive-by Compromise
id: f81776ab-a2e6-4889-84d1-e370cdd3e637
description: 'Detects browser spawning a script/shell/LOLBin child process, indicative of exploit code post-visit. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, KnownGoodDomainsList, PayloadEntropyThreshold, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1189
author: Shahrukh Khan
date: 2026-01-14
license: MIT
tags:
  - attack.initial-access
  - attack.t1189

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '1'
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\iexplore.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not filter_system_account

falsepositives:
  - Rare legitimate browser-spawned scripting.

level: medium

T1189 Drive-by Compromise

title: T1189 Drive-by Compromise
id: e3529f1b-5b5e-4125-af2d-62019fda0e97
description: 'Drive-by Compromise -- Behavior-based, Multi-platform Detection Strategy (T1189). The previous version declared logsource category network_connection while every detection field was EXECVE/process_creation argv data (an invalid category/field combination), and it correlated two independent, unlinked EXECVE matches (any browser process plus any shell/script process existing anywhere in the log) rather than an actual parent-child relationship, which single-event auditd telemetry cannot express without cross-event PID/PPID correlation. The malicious webpage content and exploit payload itself are invisible to auditd; the closest defensible single-event Linux proxy is a shell/script interpreter executed directly from a browser cache/profile directory, indicating a browser-delivered payload was run. Tune using: TempPathPatterns, UserShellWhitelist, DomainRarityThreshold.'
references:
  - https://attack.mitre.org/techniques/T1189
author: Shahrukh Khan
date: 2026-03-28
license: MIT
tags:
  - attack.initial-access
  - attack.t1189

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/bash'
      - '/sh'
      - '/python3'
  selection_browser_path:
    a1|contains:
      - '/.mozilla/firefox/'
      - '/.cache/mozilla/'
      - '/.cache/google-chrome/'
      - '/.config/google-chrome/'
      - '/.cache/chromium/'
      - '/.config/chromium/'
  condition: selection and selection_browser_path

falsepositives:
  - Drive-by compromise is primarily a browser-exploitation technique with weak Linux server relevance; legitimate scripts (backup tools, profile migration utilities, browser automation) that read or process files from a browser profile/cache directory can trigger this, and auditd cannot see the malicious webpage/exploit content itself, only the resulting file execution.

level: medium

T1189 Drive-by Compromise

title: T1189 Drive-by Compromise
id: cbbf31b7-f18e-43ec-abe0-ef914765dbf3
description: 'Drive-by Compromise — Behavior-based, Multi-platform Detection Strategy (T1189). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: SleepyUserThreshold, ExtensionInstallPolicy.'
references:
  - https://attack.mitre.org/techniques/T1189
author: Shahrukh Khan
date: 2026-06-09
license: MIT
tags:
  - attack.initial-access
  - attack.t1189

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    ParentImage|endswith:
      - '/Safari'
      - '/Google Chrome'
    Image|endswith:
      - '/bash'
      - '/osascript'
      - '/python3'

  condition: selection

falsepositives:
  - Browser-triggered helper scripts for legitimate downloads or extensions can share this same parent-child pattern.

level: high

T1189 Drive-by Compromise

title: T1189 Drive-by Compromise
id: 8bc0f7f2-43b1-41ea-93df-06accd69d7c6
description: 'Drive-by Compromise — Behavior-based, Multi-platform Detection Strategy (T1189). (Data Component: User Account Authentication; baseline tier: fallback.) Tune using: IdpAlertWindow, HighRiskCountryList, DeviceTrustLevel.'
references:
  - https://attack.mitre.org/techniques/T1189
author: Shahrukh Khan
date: 2026-01-01
license: MIT
tags:
  - attack.initial-access
  - attack.t1189

logsource:
  product: azure
  service: signinlogs

detection:
  selection:
    ResultType: '0'
    RiskLevelDuringSignIn: 'high'

  condition: selection

falsepositives:
  - Sign-ins flagged risky due to travel or a new device with no actual browser exploitation, since the drive-by delivery mechanism itself is not visible in sign-in telemetry.

level: medium

Explore