Modern browsers execute complex, potentially untrusted content every day. When a browser vulnerability results in native code execution, one of the most useful endpoint signals can be an unexpected child process created by the browser.

The source defines a high-signal behavioral hunt for this activity across Chrome, Microsoft Edge, Firefox, Brave, and Opera.

Suspicious Browser Process Relationships

The query monitors browsers creating child processes such as:

• cmd.exe;

• powershell.exe or pwsh.exe;

• mshta.exe;

• wscript.exe or cscript.exe;

• rundll32.exe;

• regsvr32.exe;

• certutil.exe;

• bitsadmin.exe;

• schtasks.exe.

These tools are legitimate, but they are unusual child processes for normal browser activity in many environments.

The source links this behavior to multiple Chrome and Chromium zero-days, including CVE-2025-2783, CVE-2025-5419, CVE-2025-6554, CVE-2025-6558, CVE-2025-13223, CVE-2025-14174, CVE-2026-2441, CVE-2026-3910, CVE-2026-5281, and CVE-2026-11645. It also notes coverage for Edge and Firefox post-exploitation.

Detection Query

data.win.system.eventID:1 and data.win.eventdata.parentImage:(*\chrome.exe or *\msedge.exe or *\firefox.exe or *\brave.exe or *\opera.exe) and data.win.eventdata.image:(*\cmd.exe or *\powershell.exe or *\pwsh.exe or *\mshta.exe or *\wscript.exe or *\cscript.exe or *\rundll32.exe or *\regsvr32.exe or *\certutil.exe or *\bitsadmin.exe or *\schtasks.exe)

The source recorded 37,947 matches in the previous 30 days.

Why a High-Signal Rule Can Still Be Noisy

The process relationship is suspicious in principle, but enterprise environments can introduce legitimate browser-triggered behavior through management tools, helper applications, extensions, testing frameworks, software installers, or custom workflows.

The large event count means the raw query should not be treated as a confirmed compromise alert without tuning.

A useful first step is to aggregate results by:

• browser;

• child process;

• hostname;

• user;

• command line;

• executable path.

This usually reveals whether the volume comes from a small number of known workflows or whether suspicious combinations are spread across the environment.

Investigation Priorities

A rare browser-to-shell relationship should be prioritized, especially when combined with:

• an unusual or encoded command line;

• file creation under temporary directories;

• external downloads;

• scheduled task creation;

• security-tool modification;

• unexpected outbound network connections.

The surrounding browser activity can also provide useful context. Analysts may review the user session, browser version, recent URLs if available, and endpoint alerts around the same time.

Tuning Strategy

Avoid broad exclusions such as ignoring all chrome.exe → cmd.exe events. Instead, identify the exact legitimate mechanism responsible for recurring events and create narrowly scoped exceptions.

For example, a specific internally approved tool may produce a known browser-child relationship on a limited set of hosts. Excluding only that application path or command-line pattern preserves visibility elsewhere.

Practical Detection Value

Browser exploitation can be difficult to identify from network traffic alone, particularly when the initial exploit is short-lived. Endpoint process telemetry provides another perspective.

Monitoring for browsers that suddenly behave like command launchers can therefore help expose post-exploitation activity even when the exact exploit is not directly observed.