-
Browser Process Spawned from an Unusual Parent
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Data Source: Elastic Endgame Data Source: Elastic Defend Data Source: Windows Security Event Logs Data Source: Microsoft Defender XDR Data Source: Sysmon Data Source: SentinelOne Resources: Investigation Guide Noise: Medium Performance: Normal Profile: Recommended Threat: Information Stealer Rule Type: Event Correlation (EQL) Platform: Windows ·Identifies instances where a browser is launched with remote debugging, headless automation, or minimal arguments from an unusual parent process. This may indicate an attempt to broker or tamper with a browser session for credential theft.
Read More -
Potential Cookies Theft via Browser Debugging
Sep 19, 2026 · Domain: Endpoint OS: Linux OS: Windows OS: macOS Use Case: Threat Detection Tactic: Credential Access Data Source: Elastic Defend Resources: Investigation Guide Data Source: Windows Security Event Logs Data Source: Sysmon Noise: High Performance: Normal Profile: Aggressive Threat: Information Stealer Rule Type: Event Correlation (EQL) Platform: Windows Platform: Linux Platform: macOS ·Identifies the execution of a Chromium based browser with the debugging process argument, which may indicate an attempt to steal authentication cookies. An adversary may steal web application or service session cookies and use them to gain access web applications or Internet services as an authenticated user without needing credentials.
Read More -
Identifies the access or file open of web browser sensitive files by an untrusted/unsigned process or osascript. Adversaries may acquire credentials from web browsers by reading files specific to the target browser.
Read More