Chrome.exe Alerts

Hi all,

Do any of you all receive these notorious Chrome.exe alerts on your EDRs or IDRs? What are these alerts? Are they automatica updates coming from Chrome extensions, or micro version updates from the browser itself? Im stumpted. They're typically something like below:

Filename: Chrome.exe
FilePath: \Device\HarddiskVolume3\Program Files\Chrome\Application
FileHash: these vary and have different hashes that register as PUPs or Grayware on VirusTotal

Find more posts tagged with

edr

chrome alerts

Comments

JDMurray

I've seen legit operations in Chrome that are interpreted as heap spraying attacks, but little else. Positive hits on extensions can be anything should be reported to the extension's vendor.

egrizzly

So are alerts from file Chrome.exe known to be from the extension installs/updates and not from the browser? @JDMurray

JDMurray

Is your EDR is triggering on the chrome.exe file on disk or on the chrome.exe process running in memory? Extensions are individual files on disk, but may appear as part of the chrome.exe process(es) in memory.