BitB: Browser Process Spawning Suspicious Child Process After Fake Overlay Interaction

Ibrahim Saud@tektrix

•updated Jun 30, 2026•4•0•2

Detects anomalous child process execution from common web browsers often associated with Browser-in-the-Browser (BitB) attacks. The rule correlates browser-spawned processes like PowerShell, cmd, or mshta with concurrent, suspicious network activity targeting login or account-related domains outside of expected conferencing platforms.