Browser Hijack Via WMI Driven Restart

Tim Peck@timpeck

•updated Dec 16, 2025•4•0•53

Detects a browser hijacking technique where a WMI-driven script terminates a running browser process (Chrome or Edge) and immediately restarts it with malicious command-line arguments to load an unauthorized extension.