Chromium Browser Instance Executed With Custom Extension

SigmaHQ Detections@sigmaHQ

•updated Aug 14, 2025•1•0•14

Detects a Chromium-based browser process being launched with the '--load-extension=' command-line flag. This flag allows an instance of the browser to be started with a custom extension, which can be abused by adversaries for persistence, data exfiltration, or other malicious activities. This technique is often associated with malware like ChromeLoader.