Windows Chromium Browser No Security Sandbox Process

This analytic detects instances where a Chrome or Chromium-based browser is launched with the `--no-sandbox` flag. This flag disables the browser's built-in security sandbox, which is a known indicator of potentially malicious or suspicious behavior. While occasionally used for development or testing, it is rarely seen in normal user activity. Threat actors often abuse this setting to execute malicious code, escape browser isolation, or for command and control, credential theft, or UI spoofing, especially when embedded in malware droppers or loaders. Investigation should focus on events originating from unusual parent processes (e.g., powershell.exe, cmd.exe, or unknown binaries) or accompanied by other suspicious activities.