• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Web Browser Process Spawned by Unexpected Parent Process

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Ibrahim Saud@tektrix
    •updated Sep 22, 2026•0•0•3

    Detects web browser processes (e.g., Chrome, Edge, Firefox) spawned by parent processes that are not typical for web browser execution. This behavior is often associated with malware (such as infostealers) using unconventional process spawning to inject code or perform credential theft.

    Sigma

    Tags

    T1555.003 - Credentials from Web BrowsersT1185 - Browser Session HijackingT1539 - Steal Web Session CookieTA0009 - CollectionProcess CreationWindowsWindows Sysmonattack.t1555.003attack.t1185attack.t1539

    Found in

    • Vidar Stealer Evolution: Virtual Machines and Custom CiphersLast updated Sep 22, 2026
    • Vidar Stealer Evolution: Virtual Machines and Custom CiphersLast updated Sep 22, 2026
    • Vidar Stealer Evolution: Virtual Machines and Custom CiphersLast updated Sep 22, 2026
    • Vidar Stealer Evolution: Virtual Machines and Custom CiphersLast updated Sep 22, 2026
    • Vidar Stealer Evolution: Virtual Machines and Custom CiphersLast updated Sep 22, 2026

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?