BioShocking: AI Browser Agent Spawning Suspicious Child Processes
Detects the execution of command-line utilities (cmd.exe, powershell.exe, wscript.exe, curl.exe) when launched directly from a web browser or associated web-related processes (e.g., chrome.exe, msedge.exe). This pattern is often indicative of drive-by downloads or malicious web content attempting to execute code on the endpoint.
Splunk (SPL)
