BrowserCore.exe launched by non-browser parent (PRT theft)

Ankit Mehta@Secvyn

•updated Aug 28, 2026•0•0•4

Detects execution of 'BrowserCore.exe' when the initiating (parent) process is not a recognized web browser (msedge.exe, chrome.exe, or firefox.exe). This rule flags potential process masquerading or misuse of the BrowserCore utility, particularly when spawned by command interpreters or the Task Scheduler.