Chromium Browser with Custom User Data Directory and Disabled GPU/3D APIs

This analytic detects instances where Chromium-based browsers (e.g., Google Chrome, Microsoft Edge, Brave, Opera, Vivaldi) are launched with the `--user-data-dir` command-line argument, combined with `--disable-gpu` or `--disable-3d-apis`. While `--user-data-dir` is a legitimate flag for multi-profile support or automation, its use alongside GPU/3D API disabling flags is frequently observed in malware and adversary tactics. This combination can indicate an attempt to run the browser in an isolated, potentially stealthy environment for activities such as credential harvesting, phishing delivery, or evasion of user session artifacts and analysis.