ChromeLoader Malware Execution via Scheduled Task

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•18

Detects execution of ChromeLoader malware via a registered scheduled task, specifically looking for PowerShell executing Chrome with a `--load-extension` argument pointing to a suspicious local path.