Tech Support - Fullscreen Browser Lure (T1204.001)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•1

Detects a browser being launched via LNK or script with explicit kiosk or fullscreen parameters to trap the user in a fake tech support HTML lure. This rule specifically looks for chrome.exe or msedge.exe being executed with command-line arguments such as '--kiosk' or '--start-fullscreen' in conjunction with an HTML or HTM file.