Browser-in-the-Browser (BitB) Post-Interaction Payload Delivery from Browser Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects anomalous post-compromise activity associated with Browser-in-the-Browser (BitB) attacks or general credential theft. Specifically, it monitors for browser processes spawning suspicious child processes (e.g., cmd.exe, powershell.exe, mshta.exe) that are typically used for payload delivery, and unauthorized access to browser-stored credential files (e.g., 'Login Data') by non-browser processes.