BeaverTail: Code.exe/node.exe Browser Credential Store Access or Browser Process Spawn

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects instances where development-related processes (such as Code.exe or node.exe) spawn web browser processes (like chrome.exe, firefox.exe, or msedge.exe). This pattern is often indicative of an adversary attempting to leverage developer environments or cross-platform applications to interact with browser-based session data, cookies, or cached credentials.