AI-Assisted Phishing - Browser Spawns Script Interpreter
Detects a web browser spawning a script interpreter or dual-use LOLBin, the execution hand-off typical of an AI-drafted phishing lure where the victim clicks a link/attachment and content is immediately executed by PowerShell, cmd, mshta, wscript or cscript. Legitimate browsers almost never spawn these interpreters as direct children, making this a high-fidelity signal of a browser-to-interpreter phishing chain as described for AI-assisted cybercrime activity.
YARA-L
