Registry Query for Chrome or Edge Installation Path by Non-Browser Process
Detects a registry or environment variable query for the Chrome or Edge installation path performed by a process other than the browser itself. This is a low-fidelity, contextual precursor indicator only and is not indicative of malicious activity on its own. It matches the initial step of the msaRAT living-off-the-browser pattern, where a non-browser process resolves the Chrome/Edge install path before driving a headless browser instance over the Chrome DevTools Protocol for covert C2. Analysts should manually correlate hits from this rule with the separate 'Headless Chrome or Edge Launch with Remote Debugging Enabled' rule, looking for the same process (Image here matching ParentImage there) triggering both events within a short time window (e.g. a few minutes), before treating this as suspicious.
Microsoft Sentinel (KQL)
