Fake Claude Installer Opens a Command Shell from the Browser

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•4•1•14

Detects a browser launching cmd.exe or PowerShell immediately after a user visits or downloads content presented as an AI coding assistant installer. This rule specifically looks for process creation events where a browser (Chrome, Edge, Firefox) is the parent process, and the child process is a command shell (cmd.exe, powershell.exe, pwsh.exe), with the command line containing keywords related to 'claude', 'install', 'setup', 'copy paste', 'mshta', or 'download'.