Browser Process Spawning Command Shell or Scripting Interpreter

Lacey Cochrane@NullVectorX

•updated Aug 4, 2026•1•0•2

This rule detects when common web browser processes spawn command-line shells or scripting interpreters. This behavior is often indicative of malicious browser extensions, browser exploitation, or remote code execution attempts, as browsers generally should not be launching native system shells.