Persona-Management Tooling on an Employee Endpoint

A device holding two or more tools, or any ixBrowser or LDPlayer hit, matches the persona workflow the reports describe and belongs to someone whose job needs neither.

union
    // optional: Cookie-Editor is common among web developers; delete this line and the next
    (DeviceTvmBrowserExtensions | where ExtensionName contains "Cookie-Editor" or ExtensionName contains "Cookie Editor" | project Timestamp = now(), DeviceId, Tool = "Cookie-Editor"),
    (DeviceProcessEvents
        | where Timestamp > ago(90d)
        | where FolderPath contains "ixBrowser" or FolderPath contains "LDPlayer"
            // optional: ShareX is common and means nothing alone; delete this line and the next
            or FileName =~ "ShareX.exe"
        | extend Tool = case(FolderPath contains "ixBrowser", "ixBrowser", FolderPath contains "LDPlayer", "LDPlayer", "ShareX")
        | project Timestamp, DeviceId, DeviceName, Tool)
| summarize DeviceName = take_anyif(DeviceName, isnotempty(DeviceName)), Tools = make_set(Tool), ToolCount = dcount(Tool), LastSeen = max(Timestamp) by DeviceId
| order by ToolCount desc, LastSeen desc

The same process match over the Endpoint data model, ranked by distinct tools per device.

```Placeholder: the Endpoint data model is populated from Windows and macOS process events.```
| tstats count min(_time) AS first_seen max(_time) AS last_seen FROM datamodel=Endpoint.Processes
    WHERE Processes.process_path="*ixBrowser*" OR Processes.process_path="*LDPlayer*"
    ```optional: ShareX is common and means nothing alone; delete this line and the next```
    OR Processes.process_name="ShareX.exe"
    BY Processes.dest, Processes.process_path
| eval tool=case(like(lower('Processes.process_path'), "%ixbrowser%"), "ixBrowser", like(lower('Processes.process_path'), "%ldplayer%"), "LDPlayer", true(), "ShareX")
| stats sum(count) AS executions dc(tool) AS tool_count values(tool) AS tools max(last_seen) AS last_seen BY Processes.dest
| convert ctime(last_seen)
| sort - tool_count, - executions

The same process match as a rule that applies to Windows and macOS process-creation telemetry.

title: Anti-Detect Browser or Android Emulator Executed on an Employee Endpoint
id: 1a900b22-a923-494b-9f4c-5af9ab13891d
status: experimental
description: >
  Detects ixBrowser, an anti-detect browser that isolates one persona per
  profile, and LDPlayer, an Android emulator used to answer identity
  verification challenges without a physical phone, on Windows and macOS.
  Both are named in operation material describing DPRK IT-worker persona
  management.
references:
  - https://haydenmckenzie.com/research/dprk-it-worker-cell-part-one
  - https://haydenmckenzie.com/research/dprk-it-worker-operation-part-two
logsource:
  category: process_creation
detection:
  selection_core:
    Image|contains:
      - 'ixBrowser'
      - 'LDPlayer'
  # optional: ShareX is common and means nothing alone; delete this line and the two below it
  selection_sharex:
    Image|endswith: '\ShareX.exe'
  condition: 1 of selection_*
falsepositives:
  - Mobile developers testing on an emulator, and social-media or advertising
    staff who manage several accounts for the business
level: medium

The same process match over Falcon ProcessRollup2 events on Windows and macOS.

#event_simpleName=ProcessRollup2
| ImageFileName=/ixBrowser|LDPlayer/i
    // optional: ShareX is common and means nothing alone; delete this line and the next
    or FileName=/^ShareX\.exe$/i
| case {
    ImageFileName=/ixBrowser/i | tool := "ixBrowser";
    ImageFileName=/LDPlayer/i | tool := "LDPlayer";
    * | tool := "ShareX";
  }
| groupBy([aid, ComputerName], function=[count(as=Executions), count(tool, distinct=true, as=ToolCount), collect([tool]), max(@timestamp, as=LastSeen)])
| sort(ToolCount, order=desc)

The same process match over Elastic Defend process events, ranked by distinct tools per host.

FROM logs-endpoint.events.process-*
| WHERE event.action IN ("start", "exec")
| EVAL path = TO_LOWER(process.executable)
| EVAL tool = CASE(
    TO_LOWER(process.name) == "sharex.exe", "ShareX",
    path LIKE "*ixbrowser*", "ixBrowser",
    path LIKE "*ldplayer*", "LDPlayer")
| WHERE tool IS NOT NULL
| STATS executions = COUNT(*), tool_count = COUNT_DISTINCT(tool), tools = VALUES(tool), last_seen = MAX(@timestamp) BY host.name
| SORT tool_count DESC, last_seen DESC

The same process match over Cortex process events, ranked by distinct tools per host.

dataset = xdr_data
| filter event_type = ENUM.PROCESS
| filter lowercase(action_process_image_path) contains "ixbrowser"
    or lowercase(action_process_image_path) contains "ldplayer"
    // optional: ShareX is common and means nothing alone; delete this line and the next
    or lowercase(action_process_image_name) = "sharex.exe"
| alter tool = if(lowercase(action_process_image_path) contains "ixbrowser", "ixBrowser", if(lowercase(action_process_image_path) contains "ldplayer", "LDPlayer", "ShareX"))
| comp count() as executions, count_distinct(tool) as tool_count, max(_time) as last_seen by agent_hostname
| sort desc tool_count, desc last_seen

Running processes and installed Chromium extensions on one host, since osquery is a point-in-time check of the machine in front of it.

SELECT 'process' AS source, name AS item, path AS detail
FROM processes
WHERE lower(path) LIKE '%ixbrowser%' OR lower(path) LIKE '%ldplayer%'
   -- optional: ShareX is common and means nothing alone; delete this line and the next
   OR lower(name) = 'sharex.exe'
-- optional: Cookie-Editor is common among web developers; delete this line and the two below it
UNION ALL
SELECT 'extension', ce.name, ce.identifier FROM users u CROSS JOIN chrome_extensions ce USING (uid) WHERE lower(ce.name) LIKE '%cookie-editor%' OR lower(ce.name) LIKE '%cookie editor%';