Suspicious Chromium Browser Instance Executed With Custom Extension

SigmaHQ Detections@sigmaHQ

•updated Aug 14, 2025•1•0•14

Detects a suspicious process spawning a Chromium-based browser process with the '--load-extension' flag to start an instance with a custom extension. This technique is often used by adversaries to establish persistence or execute malicious code within the browser environment.