Browser Launched with Security Restriction Flags
Detects the execution of common web browsers (Chrome, Firefox, Edge) with command-line arguments designed to weaken browser security. These flags, such as --disable-blink-features or --disable-sync, are often utilized by adversaries to bypass browser security controls, facilitate sandbox escape attempts, or maintain a consistent environment for session hijacking and credential harvesting.
Microsoft Sentinel (KQL)

