Browser Spawning Cmdexe With Tempstaging Command

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•2•0•2

Detects when a web browser (Chrome, Edge, Firefox, Brave) spawns `cmd.exe` with a command line that includes a temporary directory path and specific command separators, indicating potential malicious copy-paste activity or drive-by compromise. The rule looks for a long command containing `&&`, `& rem`, `tar -xf`, or `rundll32` within the temporary directory.