Chaos Ransomware · msaRAT: Living off the Browser

Cisco Talos published a technical analysis on 2026-07-23 of msaRAT, a Rust remote access trojan attributed to the Chaos ransomware-as-a-service group. The attacker objective is a command channel that survives network-tier detection: msaRAT is deployed after hands-on-keyboard access is already established, and before the encryptor runs.

The tradecraft is the point. msaRAT locates Chrome or Edge on the victim host, launches its own copy of that browser in headless mode with the CDP remote-debugging port enabled, connects to it over a WebSocket on 127.0.0.1, disables Content Security Policy with Page.setBypassCSP, registers five callbacks with Runtime.addBinding (msaOpen, msaClose, msaError, msaMessage, dataAck) and injects JavaScript with Runtime.evaluate. That JavaScript does all the networking. It pulls STUN/TURN configuration from a Cloudflare Workers endpoint, negotiates a WebRTC DataChannel whose SDP answer deliberately carries no ICE candidates so that every byte is forced through global.turn.twilio.com, and then relays C2 frames that are encrypted twice: DTLS by the browser, plus a ChaCha-Poly1305 layer keyed by an ECDH exchange inside the RAT.

The consequence for defenders is blunt. All network traffic from the RAT process itself is loopback only. Every external byte leaves from a signed, trusted browser process, headed for Cloudflare and Twilio infrastructure that almost every enterprise allowlists. Firewall, proxy and NetFlow tiers see a browser doing browser things.

Delivery is deliberately dull by comparison: curl.exe pulls update_ms.msi into C:\ProgramData from an attacker host, over plain HTTP on TCP/443, which slips past firewall rules that trust the port number without inspecting the protocol. The MSI impersonates a Windows update, and its custom action CA_Run_EA2AEBC3 fires on InstallFinalize to load lib.dll from the MSI Binary table entry Bin_lib_EA2AEBC3 straight into memory. The DLL exports a single function named RUN.

Defender priority: the two published atomic indicators can be rotated tomorrow. The technique cannot. Hunt for chrome.exe or msedge.exe launched with --remote-debugging-port and --headless by a parent that is not a browser and not a sanctioned automation runner (Q1). That single behavioral query survives full infrastructure rotation and is the highest-value detection in this pack.

Decisions taken

• No file hashes ship as indicators. Talos published none for lib.dll or update_ms.msi. Secondary reporting refers loosely to "a file hash" in the indicator set, but the official IOC file does not contain one. The IOC appendix therefore carries labelled REPLACE_WITH_ placeholders rather than an invented value.
• Table 1 and Table 2 of the Talos report are images, so the exact six environment-variable paths and the full browser flag list are not recoverable from the fetched text. Queries are built on the flag names that appear in prose across three sources (--headless, --remote-debugging-port, --user-data-dir) rather than on a reconstructed flag string.
• Chaos initial access is not covered by this pack. Talos does not state how the analysed host was reached. The group's documented playbook (spam flood, vishing, Quick Assist, RMM tooling) is carried into the hardening section only.

Attack chain

Hunt hypotheses (ordered by fidelity)

Perishability: both atomic indicators are rented infrastructure. The Workers subdomain is free to reissue and the staging IP is disposable. Treat Q1 through Q4 as the durable detections and these two rows as a fast, cheap retro-sweep.

N1 · Sysmon Event ID 1 (Process Create)

Filter Image ending in chrome.exe or msedge.exe where CommandLine contains --remote-debugging-port. Sysmon adds what Falcon does not: OriginalFileName and the signature fields, which let you separate a genuine Google or Microsoft binary from a renamed copy.

N2 · Sysmon Event ID 3 (Network Connect)

Loopback connections are recorded here even when EDR suppresses them. Look for a non-browser Image connecting to 127.0.0.1 on a high ephemeral port within seconds of a Sysmon EID 1 browser launch on the same host.

N3 · Sysmon Event ID 22 (DNS Query)

Per-process DNS attribution for workers.dev and turn.twilio.com lookups. This is the fallback when Falcon DnsRequest lacks process context in your tenant.

N4 · Windows Application log, source MsiInstaller

Event IDs 1033 (product installed) and 11707 (install completed successfully) record the product name from the MSI property table. Hunt for products claiming to be a Windows update that were installed from C:\ProgramData, and cross-check against your patching system's own inventory. Anything the patch system did not install is a lead.

N5 · Proxy / TLS-inspection logs

Requests carrying a HeadlessChrome user agent. Then, on those same requests, an Origin or Referer claiming a Microsoft site while the destination host is a workers.dev subdomain. That mismatch is the single best network-tier signal in this campaign.

N6 · Perimeter firewall / IDS

Any session where the negotiated protocol is plain HTTP but the destination port is 443. Confirm Talos Snort SIDs 1:66839, 1:66840, 1:66841 (Snort 2) and 1:301587, 1:66839 (Snort 3) are enabled, and that ClamAV signature Win.Downloader.ChaosRaas-10060321-0 is current.

N7 · Browser policy audit

On a sample of endpoints, read chrome://policy and edge://policy (or the registry keys in Playbook P1) and confirm RemoteDebuggingAllowed is present and set to Disabled. A host where the policy is absent is a host where this technique still works.

N8 · Retro-hunt collected MSI samples

Any MSI held in your sandbox or mail-gateway archive: dump the CustomAction and Binary tables and string-search for CA_Run_ prefixed actions paired with a Bin_lib_ Binary entry, and for exports named RUN. Also string-scan for the five binding names msaOpen, msaClose, msaError, msaMessage, dataAck.

// HUNT: Chrome/Edge launched headless with a CDP debug port by a non-browser parent
// MITRE: T1219 · T1071.001 · T1562.001
// CONF: high  FP: medium  COST: low | REQUIRES: ProcessRollup2 with CommandLine capture
// FALSE POSITIVES: Puppeteer/Playwright/Selenium runners, Electron shells, PDF render services
#event_simpleName=/^(Synthetic)?ProcessRollup2$/
| FileName=/^(chrome|msedge)\.exe$/i
| CommandLine=/--remote-debugging-(port|pipe)/i
| CommandLine=/--headless/i
| ParentBaseFileName!=/^(chrome|msedge|firefox|brave|opera|explorer|userinit)\.exe$/i
// TUNING: baseline 14 days, then exclude only the parents you can name and justify
// TUNING: | ParentBaseFileName!=/^(node|python|pwsh|java|dotnet)\.exe$/i
// TUNING: | ComputerName!=/^(BUILD|CI|QA)-/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData], limit=200)

// HUNT: Browser launched with a --user-data-dir under ProgramData or a temp path
// MITRE: T1219 · T1564
// CONF: high  FP: medium  COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: kiosk/imaging tooling, Citrix profile redirection, packaged browser tests
#event_simpleName=/^(Synthetic)?ProcessRollup2$/
| FileName=/^(chrome|msedge)\.exe$/i
| CommandLine=/--user-data-dir/i
| CommandLine=/(programdata|\\temp\\|\\appdata\\local\\temp|\\windows\\temp|\\public\\)/i
// TUNING: exclude your VDI profile root only, never the whole ProgramData branch
// TUNING: | CommandLine!=/--user-data-dir=.{0,120}\\Citrix\\/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine], limit=200)

// HUNT: Browser process spawned by msiexec, rundll32, a script host or a download tool
// MITRE: T1218.007 · T1219
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: MSI-packaged browser installers launching the browser once at first run
#event_simpleName=/^(Synthetic)?ProcessRollup2$/
| FileName=/^(chrome|msedge)\.exe$/i
| ParentBaseFileName=/^(msiexec|rundll32|wscript|cscript|mshta|curl|certutil|regsvr32)\.exe$/i
// TUNING: first-run installer launches carry a make-default or welcome-page argument
// TUNING: | CommandLine!=/--make-default-browser/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

// HUNT: Browser process running as SYSTEM / LOCAL SERVICE / NETWORK SERVICE
// MITRE: T1219 · T1564
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2 (no CommandLine needed)
// FALSE POSITIVES: rare. Some kiosk and digital-signage stacks run a browser as a service.
#event_simpleName=/^(Synthetic)?ProcessRollup2$/
| FileName=/^(chrome|msedge)\.exe$/i
| UserSid=/^S-1-5-(18|19|20)$/
// TUNING: | ComputerName!=/^(KIOSK|SIGNAGE)-/i
| table([@timestamp, ComputerName, UserSid, ParentBaseFileName, FileName, CommandLine], limit=200)

// HUNT: LOLBin download utility fetching an .msi into ProgramData
// MITRE: T1105 · T1218.007
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: a small number of packaging agents stage MSIs this way. Name them, then exclude them.
#event_simpleName=/^(Synthetic)?ProcessRollup2$/
| FileName=/^(curl|certutil|bitsadmin|wget)\.exe$/i
| CommandLine=/\.msi/i
| CommandLine=/programdata/i
// TUNING: | ParentBaseFileName!=/^(ccmexec|intunemanagementextension|pdqdeployrunner)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

// HUNT: Plain-HTTP URL explicitly pinned to port 443 in any process command line
// MITRE: T1105 · T1571
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: rare. Some internal tooling and health-check scripts are misconfigured this way.
#event_simpleName=/^(Synthetic)?ProcessRollup2$/
| CommandLine=/http:\/\/[^\s]+:443/i
// TUNING: | CommandLine!=/http:\/\/(localhost|127\.0\.0\.1):443/i
| table([@timestamp, ComputerName, UserName, FileName, ParentBaseFileName, CommandLine], limit=200)

// HUNT: msiexec.exe installing from a user-writable directory
// MITRE: T1218.007 · T1036.005
// CONF: medium  FP: medium  COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: SCCM, Intune, PDQ, Ninja and other agents that stage MSIs under ProgramData
#event_simpleName=/^(Synthetic)?ProcessRollup2$/
| FileName=/^msiexec\.exe$/i
| CommandLine=/(\\programdata\\|\\users\\|\\windows\\temp\\|\\public\\)/i
// TUNING: exclude by PARENT, not by path. The path is the signal.
// TUNING: | ParentBaseFileName!=/^(ccmexec|intunemanagementextension|pdqdeployrunner|ninjarmmagent)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

// HUNT: Same host runs a download utility AND an MSI install touching ProgramData
// MITRE: T1105 · T1218.007
// CONF: medium  FP: medium  COST: medium | REQUIRES: ProcessRollup2
// FALSE POSITIVES: patch and packaging agents that download then install from ProgramData
#event_simpleName=/^(Synthetic)?ProcessRollup2$/
| FileName=/^(curl|certutil|bitsadmin|wget|msiexec)\.exe$/i
| CommandLine=/programdata/i
| groupBy([ComputerName], function=[collect([FileName, ParentBaseFileName, CommandLine], limit=25), count(field=FileName, distinct=true, as=DistinctTools)])
| DistinctTools >= 2
// TUNING: run over a 24h window first. Widening past 7d inflates cost with no fidelity gain.
// TUNING: drop hosts whose collected rows show only your patch agent as the parent
| sort(DistinctTools, order=desc, limit=200)

// HUNT: Direct hits on published msaRAT infrastructure (retro-sweep)
// MITRE: T1071.001 · T1105
// CONF: high  FP: low  COST: low | REQUIRES: NetworkConnectIP4, DnsRequest
// FALSE POSITIVES: none. Any hit is an incident.
#event_simpleName=/^(NetworkConnectIP4|DnsRequest)$/
| RemoteAddressIP4="172.86.126.18" or DomainName=/ols-img-12\.workers\.dev$/i
// TUNING: not required. Escalate every hit directly.
| table([@timestamp, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort, DomainName], limit=200)

// HUNT: Browser resolving a workers.dev signalling host and a Twilio TURN relay
// MITRE: T1071.001 · T1090.002 · T1102
// CONF: medium  FP: high  COST: medium | REQUIRES: DnsRequest with ContextBaseFileName
// FALSE POSITIVES: Teams, Zoom, Twilio Video and any real WebRTC app. Real workers.dev SaaS.
#event_simpleName=/^DnsRequest$/
| DomainName=/(\.workers\.dev|turn\.twilio\.com)$/i
| ContextBaseFileName=/^(chrome|msedge)\.exe$/i
| groupBy([ComputerName, ContextBaseFileName, DomainName], function=count(as=Lookups))
// TUNING: allowlist the workers.dev hosts your business actually uses, then review the remainder
// TUNING: | DomainName!=/^(status|api)\.example\.workers\.dev$/i
// TUNING: only escalate hosts that also appear in Q1 or Q4 in the same window
| sort(Lookups, order=desc, limit=200)

// HUNT: Non-browser process holding repeated loopback sessions (CDP client shape)
// MITRE: T1219 · T1090.001
// CONF: medium  FP: high  COST: medium | REQUIRES: NetworkConnectIP4 with loopback retained
// FALSE POSITIVES: dev tooling, local proxies, EDR/agent IPC, DB clients, Docker Desktop
#event_simpleName=/^NetworkConnectIP4$/
| RemoteAddressIP4="127.0.0.1"
| ContextBaseFileName!=/^(chrome|msedge|firefox|svchost|code|node|python|teams|outlook|slack)\.exe$/i
| groupBy([ComputerName, ContextBaseFileName], function=[count(as=LoopbackConns), collect([RemotePort], limit=15)])
| LoopbackConns > 5
// TUNING: baseline 7 days and keep only ContextBaseFileName values seen on under 1% of hosts
// TUNING: | ContextBaseFileName!=/^(com\.docker\.backend|ssh|mysqld|nginx)\.exe$/i
// TUNING: confirm your sensor policy retains loopback connections before trusting an empty result
| sort(LoopbackConns, order=desc, limit=200)

// HUNT: Shadow copy / backup catalog destruction ahead of the Chaos encryptor
// MITRE: T1490 · T1486
// CONF: high  FP: medium  COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: backup software pruning its own catalogs, imaging and sysprep workflows
#event_simpleName=/^(Synthetic)?ProcessRollup2$/
| FileName=/^(vssadmin|wmic|wbadmin|bcdedit|powershell|pwsh|diskshadow)\.exe$/i
| CommandLine=/(delete\s+shadows|shadowcopy\s+delete|delete\s+catalog|recoveryenabled\s+no|ignoreallfailures|win32_shadowcopy)/i
// TUNING: exclude only your named backup agent as the parent process
// TUNING: | ParentBaseFileName!=/^(veeam|backupexec|acronis|commvault)[a-z]*\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

Field note: every field used above is a standard Falcon data-model field. RemotePort and ContextProcessId exist in both string and _decimal forms depending on repo and sensor version. If a numeric comparison on RemotePort returns nothing in Q11, switch to RemotePort_decimal. Loopback retention in NetworkConnectIP4 is tenant-configurable, so ⚠ validate in tenant before treating an empty Q11 result as a clean bill of health.

Three of the twelve queries are strong enough to promote to Custom IOAs. The rest stay as scheduled hunts.

IOA-1 · Browser started with a CDP remote-debugging port by a non-browser parent

IOA-2 · Browser process spawned by msiexec or rundll32

IOA-3 · Plain-HTTP URL pinned to port 443

Investigate-only: Q8, Q10 and Q11 must not become IOAs. Q10 and Q11 fire on legitimate infrastructure and legitimate local IPC, and Q8 is an aggregation that has no single-event form. Run them as scheduled searches feeding a hunt queue, and correlate their output against IOA-1 hits.

type,value,action,severity,expiration,description,tags
ipv4,172.86.126.18,detect,high,2027-01-24,msaRAT MSI staging host (plain HTTP on TCP/443),campaign:ChaosMsaRAT
domain,is-01-ast.ols-img-12.workers.dev,detect,high,2027-01-24,msaRAT WebRTC signalling relay,campaign:ChaosMsaRAT
sha256,REPLACE_WITH_LIBDLL_SHA256,prevent,critical,2027-01-24,msaRAT lib.dll payload (no hash published by Talos),campaign:ChaosMsaRAT
sha256,REPLACE_WITH_UPDATEMSMSI_SHA256,prevent,critical,2027-01-24,update_ms.msi dropper (no hash published by Talos),campaign:ChaosMsaRAT
# DO NOT IMPORT: stun2.l.google.com and global.turn.twilio.com are legitimate services.
# Blocking them breaks real WebRTC. Use them as correlation context only.
# workers.dev is Cloudflare shared infrastructure. Block the single host above, never the parent domain.

BEHAVIOR-1  chrome.exe|msedge.exe launched with --remote-debugging-port AND --headless
            by a parent that is not a browser  (highest value, technique-level)
BEHAVIOR-2  chrome.exe|msedge.exe launched with --user-data-dir under
            C:\ProgramData, %TEMP%, C:\Windows\Temp or C:\Users\Public
BEHAVIOR-3  chrome.exe|msedge.exe whose parent is msiexec.exe or rundll32.exe
BEHAVIOR-4  chrome.exe|msedge.exe running under S-1-5-18 / S-1-5-19 / S-1-5-20
BEHAVIOR-5  Any command line containing an http:// URL pinned to :443
BEHAVIOR-6  A process whose ENTIRE network footprint is 127.0.0.1 while a browser
            it spawned egresses to Cloudflare and Twilio
BEHAVIOR-7  MSI installed from C:\ProgramData whose product name claims to be a
            Windows update, with no matching record in the patch system
BEHAVIOR-8  HTTP request with a HeadlessChrome user agent whose Origin/Referer
            claims a Microsoft site but whose destination is a workers.dev host

Family        msaRAT  (Rust, Tokio async runtime)
Group         Chaos ransomware-as-a-service (first confirmed February 2025)
Dropper       update_ms.msi   (impersonates a Windows update)
Payload       lib.dll         (single export: RUN)
MSI artefacts CA_Run_EA2AEBC3        custom action, fires on InstallFinalize
              Bin_lib_EA2AEBC3       Binary table entry holding the DLL
CDP bindings  msaOpen  msaClose  msaError  msaMessage  dataAck
CDP methods   Page.setBypassCSP  Runtime.addBinding  Runtime.evaluate
              Target.createTarget  Page.enable  Runtime.enable
CDP endpoint  GET /json/list/ on the loopback debug port
Signalling    GET and POST /token/v1/{UID} on the Workers host
Crypto        DTLS (browser) + ChaCha-Poly1305 keyed by ECDH, 0xFE handshake frame
Vendor cov.   ClamAV  Win.Downloader.ChaosRaas-10060321-0
              Snort2  1:66840  1:66841  1:66839
              Snort3  1:301587  1:66839

# PowerShell. Run per host or via your RMM. Reports hosts where the
# CDP debugging technique still works.
$paths = @(
  @{ N='Chrome'; P='HKLM:\SOFTWARE\Policies\Google\Chrome' },
  @{ N='Edge';   P='HKLM:\SOFTWARE\Policies\Microsoft\Edge' }
)
foreach ($p in $paths) {
  $v = (Get-ItemProperty -Path $p.P -Name RemoteDebuggingAllowed -EA SilentlyContinue).RemoteDebuggingAllowed
  $state = if ($v -eq 0) { 'BLOCKED' } else { 'EXPOSED' }
  [pscustomobject]@{ Browser=$p.N; RemoteDebuggingAllowed=$v; Status=$state }
}
# Also confirm Windows Installer cannot be abused for elevated installs:
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer' -Name AlwaysInstallElevated -EA SilentlyContinue
Get-ItemProperty 'HKCU:\SOFTWARE\Policies\Microsoft\Windows\Installer' -Name AlwaysInstallElevated -EA SilentlyContinue
# Expect either absent or 0. A value of 1 in BOTH hives is a privilege-escalation path.

Placeholders are deliberate. The two REPLACE_WITH_ rows are not an oversight. Talos published no file hashes for msaRAT, and secondary reporting that mentions "a file hash" is not corroborated by the official IOC file. Rather than ship a plausible-looking invented hash, the rows are labelled and left for you to fill from your own sample. Every non-placeholder value in the CSV traces back to a saved snapshot of the Talos IOC file.

P1 · Disable browser remote debugging (H-I1)

Deploy via GPO Preferences, Intune, or your RMM. Registry form shown so it can be pushed anywhere.

# 1. Chrome and Edge: block the CDP remote-debugging port by enterprise policy.
#    With this set, --remote-debugging-port is refused and msaRAT has no channel.
New-Item -Path 'HKLM:\SOFTWARE\Policies\Google\Chrome'   -Force | Out-Null
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Edge'  -Force | Out-Null

New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Google\Chrome' `
  -Name 'RemoteDebuggingAllowed' -PropertyType DWord -Value 0 -Force | Out-Null
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Edge' `
  -Name 'RemoteDebuggingAllowed' -PropertyType DWord -Value 0 -Force | Out-Null

# 2. Verify (expect 0 for both).
'Google\Chrome','Microsoft\Edge' | ForEach-Object {
  $p = "HKLM:\SOFTWARE\Policies\$_"
  [pscustomobject]@{
    Policy = $p
    Value  = (Get-ItemProperty $p -Name RemoteDebuggingAllowed -EA SilentlyContinue).RemoteDebuggingAllowed
  }
}

# 3. Confirm it took effect in the browser itself: open chrome://policy and
#    edge://policy and check RemoteDebuggingAllowed shows as Disabled.
#    NOTE: developers and QA who legitimately need CDP must be scoped into a
#    separate OU or Intune group. Do NOT leave the policy off fleet-wide for them.

P2 · Block MSI execution from user-writable paths (H-I2)

# AppLocker: deny Windows Installer files from user-writable locations,
# then allow ONLY your software-distribution agent's staging directory.
# Import into a test GPO first. Audit-only mode for 14 days before enforcing.

# a. Put AppLocker into Audit mode for MSI rules
Set-AppLockerPolicy -XmlPolicy .\msi-audit.xml -Merge

# msi-audit.xml rule intent (author in the AppLocker GUI or edit the XML):
#   DENY   Path  %OSDRIVE%\ProgramData\*.msi
#   DENY   Path  %OSDRIVE%\Users\*\AppData\Local\Temp\*.msi
#   DENY   Path  %WINDIR%\Temp\*.msi
#   DENY   Path  %OSDRIVE%\Users\Public\*.msi
#   ALLOW  Path  %OSDRIVE%\ProgramData\YourDistributionAgent\Cache\*.msi
#   ALLOW  Publisher  (your internal code-signing certificate)

# b. Review what would have been blocked before enforcing
Get-WinEvent -LogName 'Microsoft-Windows-AppLocker/MSI and Script' -MaxEvents 500 |
  Where-Object { $_.Id -in 8003,8006 } |
  Select-Object TimeCreated, Id, Message | Format-List

# c. Switch to Enforce only after (b) is clean for 14 days.

P3 · Windows Installer elevation hardening (H-I5)

# AlwaysInstallElevated = 1 in BOTH hives lets any user install an MSI as SYSTEM.
# That converts a user-context foothold into a SYSTEM implant with no exploit.
foreach ($hive in 'HKLM','HKCU') {
  $path = "${hive}:\SOFTWARE\Policies\Microsoft\Windows\Installer"
  New-Item -Path $path -Force | Out-Null
  New-ItemProperty -Path $path -Name 'AlwaysInstallElevated' `
    -PropertyType DWord -Value 0 -Force | Out-Null
}

# Verify (expect 0 or absent in both hives)
'HKLM','HKCU' | ForEach-Object {
  $p = "${_}:\SOFTWARE\Policies\Microsoft\Windows\Installer"
  [pscustomobject]@{
    Hive  = $_
    Value = (Get-ItemProperty $p -Name AlwaysInstallElevated -EA SilentlyContinue).AlwaysInstallElevated
  }
}

# Related: disable user installs of MSIs entirely where your estate allows it.
# GPO: Computer Configuration > Administrative Templates > Windows Components >
#      Windows Installer > "Prohibit User Installs" = Enabled, Hide User Installs

P4 · Post-deployment CQL spot-check

Run this a week after P1. It confirms the control is doing work, not just that a registry value exists.

// Any browser still accepting a CDP debug flag after policy deployment.
// A non-empty result means the policy did not apply on those hosts.
#event_simpleName=/^(Synthetic)?ProcessRollup2$/
| FileName=/^(chrome|msedge)\.exe$/i
| CommandLine=/--remote-debugging-(port|pipe)/i
| groupBy([ComputerName], function=count(as=Launches))
| sort(Launches, order=desc, limit=500)

P5 · Proxy category change for unknown Workers hosts (H-N4)

# Intent, expressed for a generic secure web gateway. Translate to your vendor.
#
# 1. Create a URL category: "cloudflare-workers-unknown"
#      pattern:  *.workers.dev
# 2. Create an allowlist category: "cloudflare-workers-sanctioned"
#      populate with the exact Workers hostnames your business owns
# 3. Policy order:
#      allow + no-log     cloudflare-workers-sanctioned
#      allow + FULL LOG   cloudflare-workers-unknown   <-- inspect, do not block
#
# Do NOT block *.workers.dev. It is Cloudflare shared infrastructure and blocking
# it breaks legitimate services. The goal is visibility, so a new signalling host
# shows up in a log review rather than in an incident report.
#
# 4. Add a standing alert on: user-agent contains "HeadlessChrome"
#    AND destination category = cloudflare-workers-unknown

Known gaps and what to do about them

• In-memory DLL load from the MSI Binary table (T1620). There is no file write, so no file-creation event exists to hunt. Mitigate by catching the msiexec parent relationship instead (Q3, Q7) and by retro-hunting collected MSI samples for CA_Run_ plus Bin_lib_ pairs (native hunt N8).
• Browser path discovery (T1518). Registry reads generate no telemetry in any EDR. Not huntable, and not worth chasing. The next step in the chain (the browser launch) is fully visible.
• CDP method calls (T1562.001, T1059.007). No Falcon field carries CDP method names. The only realistic visibility is a network sensor that can see the loopback WebSocket, which almost nobody deploys. Control H-I1 removes the capability instead, which is the correct answer to an undetectable step.
• Payload encryption (T1573.002). Detection is not the tool here. Double encryption inside a legitimate WebRTC channel is opaque by design.
• Loopback retention (Q11). Tenant-dependent. If gate G2 fails, Q11 is a false sense of coverage and should be replaced with Sysmon EID 3 (native hunt N2) rather than left running.

Validation gates for all of the above are in section 11. Do not promote any query to an alert until G4 through G8 have passed on your own data, and do not treat a clean Q11 result as meaningful until G2 confirms the telemetry exists.

Provenance: the fetched text of every source above is saved verbatim in ChaosMsaRAT-BrowserC2-Hunt-sources/ alongside this file. Every atomic indicator shipped in section 10 traces back to one of those snapshots.