Registry Query for Chrome/Edge Install Path as Browser-Discovery Guardrail

Luís Marques@remotecodeexecution

•updated Jul 24, 2026•0•0•2

Detects msiexec.exe process interacting with Windows Registry keys associated with Chrome or Edge browser installation directories. This behavior is indicative of browser discovery activities often performed by malware, such as msaRAT, prior to establishing a headless CDP (Chrome DevTools Protocol) session for C2 communication.