MiniJunk Backdoor: PowerShell/cmd Spawned by Browser Post-Download
Detects instances where common web browsers (Chrome, Edge, Firefox, IE) act as the parent process for scripting interpreters such as PowerShell or cmd.exe. This behavior is highly irregular for standard browsing activity and is often indicative of malicious code execution, such as a drive-by download or browser exploit triggering secondary payload execution.
Sigma
