Browser Started with Remote Debugging Enabled
This rule detects the launch of web browsers (both Chromium-based and Firefox) with command-line arguments that enable remote debugging. This functionality, while legitimate for developers, can be abused by attackers to inject malicious code, steal credentials, or perform browser session hijacking. The rule specifically looks for '--remote-debugging-' in Chromium-based browsers and '-start-debugger-server' in Firefox.
Sigma
