Chrome Evasion Flags (FlutterShell)
This rule detects the use of specific command-line flags in Google Chrome processes that are associated with the FlutterShell backdoor. These flags, '--hide-crash-restore-bubble' and '--disable-session-crashed-bubble', are used by FlutterShell to suppress crash warnings after forcing a restart, indicating an attempt to evade detection or maintain persistence.
Microsoft Sentinel (KQL)
