Browser-Spawned Process Execution After Phantom Domain Redirect (T1204.002)

Duo Tech@duotech

•updated Jul 1, 2026•0•0•1

Detects the execution of known command-line utilities, script interpreters, or installers spawned by web browsers from high-risk directories such as the User Downloads, Temp, or TMP folders. This behavior is indicative of a user downloading and executing malicious files or scripts directly from a web browser.