Malvertising Browser Chain to Unsigned Payload
This rule detects a suspicious chain of events starting from a web browser (Chrome, Edge, or Firefox) initiating a process like PowerShell, Cmd, Msiexec, or Rundll32. The detection is further narrowed down by looking for specific command-line arguments related to downloads or temporary directories, and crucially, by identifying that the executed payload is unsigned or has an untrusted signature. This pattern is indicative of malvertising leading to the execution of potentially malicious, unsigned software.
Microsoft Sentinel (KQL)
