Headless Browser Spawned by msiexec with CDP Remote Debugging Enabled

Luís Marques@remotecodeexecution

•updated today•0•0•0

Detects msiexec.exe launching Chrome or Edge in headless mode with a remote debugging port and a custom user-data directory, matching the browser-hijacking stage used by msaRAT.