Browser Spawning Script Interpreters or Living off the Land Binaries

Shadows VMB@Vemorian_Mort

•updated 7 days ago•7•0•23

Detects when a web browser (such as Chrome, Edge, Firefox, Internet Explorer, Brave, or Opera) spawns common command interpreters, scripting engines, or Living off the Land Binaries (LOLBins) like cmd, powershell, mshta, rundll32, or certutil. This behavior is often indicative of a drive-by compromise or browser exploitation attempt.