CrowdStrike Brings Enterprise Browser Security to Falcon Platform: What Defenders Must Do Now

CrowdStrike has announced the integration of enterprise browser security capabilities directly into the Falcon platform, extending its sensor-level visibility into the application that has quietly become the most exploited attack surface in the modern enterprise: the web browser. This is not a cosmetic feature add. It is a direct response to a shift every IR team has felt over the last 18 months — initial access has moved from the inbox attachment to the browser session.

In our own incident response engagements through 2025 and into 2026, the browser has been the delivery vehicle for the majority of intrusions we investigate: adversary-in-the-middle (AiTM) phishing kits that steal session tokens and bypass MFA, malicious browser extensions that scrape credentials and session cookies, drive-by compromise through watering holes and malvertising, and HTML smuggling that walks payloads straight past secure email gateways. Traditional email security and network controls were architected for a threat model that no longer dominates. CrowdStrike's move acknowledges what defenders already know: if you cannot see inside the browser, you are blind to the most active phase of the modern kill chain.

This post breaks down what the capability means technically, the threat landscape it addresses, how to hunt for browser-borne compromise with your existing telemetry today, and the hardening steps you should implement regardless of whether you adopt the new Falcon module.

Why the Browser Became the Primary Attack Surface

Three structural shifts converged to make this happen:

1. SaaS moved the perimeter into the browser. Your users authenticate to M365, Google Workspace, Salesforce, Workday, and your IdP through a browser tab. Steal the session token from that tab and the attacker inherits the user's entire cloud identity — no malware payload, no endpoint alert, no failed login anomaly.

2. AiTM phishing kits industrialized session theft. Kits like Evilginx-style frameworks and their commercial successors proxy the real login page, capture credentials and the post-authentication session cookie, and render MFA push fatigue and one-time codes irrelevant. The resulting token replay is nearly invisible to network controls.

3. Browser extensions became a shadow supply chain. Extensions request broad permissions — read and change all data on websites you visit — and users grant them reflexively. Compromised or outright malicious extensions have repeatedly been caught exfiltrating session data, injecting ads, and harvesting credentials. Extension compromise is now a recognized supply-chain intrusion vector, and most EDR deployments have zero visibility into what extensions are installed or what they are doing.

Technical Analysis: What Browser Security in Falcon Means

Based on CrowdStrike's announcement, the capability brings browser-layer telemetry and enforcement into the existing Falcon sensor architecture rather than requiring a separate agent or a rip-and-replace enterprise browser deployment. From a defender's perspective, the meaningful elements are:

In-browser visibility: Inspection of web sessions at the point of execution — URLs rendered, scripts executed, extension behavior — rather than relying solely on network-layer proxies that TLS inspection gaps and remote workers routinely bypass.
Phishing and malicious site protection at the endpoint: Blocking AiTM phishing pages and credential-harvesting sites even when the user is off-network, on a personal hotspot, or outside the corporate VPN.
Extension governance: Visibility into installed extensions, their permission scopes, and risk posture — closing the shadow supply-chain blind spot described above.
SaaS session protection: Detection of anomalous session behavior consistent with token theft and replay.
Consolidated telemetry: Browser events feeding into the same Falcon console, detections, and investigation workflows analysts already use, rather than a siloed point product.

Exploitation status context: There is no single CVE attached to this announcement — it is a platform capability launch, not a vulnerability disclosure. The threat techniques it targets, however, are among the most actively exploited in the wild today. AiTM phishing and session token theft are observed in a large share of business email compromise and SaaS intrusion cases, and malicious extension campaigns continue to surface on the Chrome Web Store and third-party extension channels throughout 2025 and 2026. Treat this as a detection-and-control gap announcement against confirmed, ongoing threat activity — not a theoretical risk.

Detection & Response

You do not need to wait for a new module to hunt browser-borne compromise. The following detections target the behaviors that matter — browser processes spawning interpreters (a classic post-exploitation signal after drive-by or HTML smuggling), suspicious extension sideloading, and AiTM/session-theft artifacts. These are tuned for high fidelity: they should not fire on normal browsing.

Sigma Rules

YAML

---
title: Browser Process Spawning Command or Script Interpreter
id: 6f2a9c41-3b7e-4d15-9a82-7c4e5f1a2b3d
status: experimental
description: Detects Chrome, Edge, or Firefox spawning cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe — a strong indicator of drive-by compromise, HTML smuggling payload execution, or malicious extension behavior.
references:
  - https://attack.mitre.org/techniques/T1204/002/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate browser-launched installers or enterprise web apps with signed helper utilities
level: high
---
title: Suspicious Browser Extension Sideload via Command Line
id: 2d8b4e7a-91c3-4f26-b5d8-0e1a6c9f3d47
status: experimental
description: Detects browsers launched with --load-extension or enterprise policy extension forcing flags, a technique used to sideload unsigned malicious extensions that harvest session data.
references:
  - https://attack.mitre.org/techniques/T1176/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1176
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
  selection_cli:
    CommandLine|contains:
      - '--load-extension'
      - '--disable-extensions-except'
      - '--install-extension'
  condition: selection_img and selection_cli
falsepositives:
  - Developer workstations doing legitimate extension development (scope exclusions by user/host group)
level: medium
---
title: Browser Extension Preferences File Modified by Non-Browser Process
id: 9c1f5d28-4e6a-4b83-a7d2-5f8e3b1c6a90
status: experimental
description: Detects non-browser processes modifying Chrome or Edge extension preferences/settings files, indicating extension tampering or malicious extension registration for persistence.
references:
  - https://attack.mitre.org/techniques/T1176/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1176
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Google\Chrome\User Data\Default\Extensions\'
      - '\Microsoft\Edge\User Data\Default\Extensions\'
      - '\Google\Chrome\User Data\Default\Secure Preferences'
      - '\Microsoft\Edge\User Data\Default\Secure Preferences'
  filter_browser:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
  condition: selection_path and not filter_browser
falsepositives:
  - Enterprise software deployment tools pushing managed extensions (verify signer and change tickets)
level: high

KQL — Microsoft Sentinel / Defender Hunting

KQL — Microsoft Sentinel / Defender

// Hunt: Browser spawning script interpreters or LOLBins (post-drive-by execution)
// Fires on the parent-child relationship that almost never occurs legitimately
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName,
    InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, ReportId
| order by TimeGenerated desc
;

// Hunt: Session token theft indicators — sign-ins from anomalous ASN/IPs immediately
// following successful auth, consistent with AiTM phishing token replay
SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType == 0
| summarize arg_max(TimeGenerated, *) by UserPrincipalName, SessionId = tostring(parse_json(SessionId))
| summarize SigninCount = count(),
    DistinctIPs = dcount(IPAddress), IPs = make_set(IPAddress),
    ASNs = make_set(NetworkLocationDetails)
    by UserPrincipalName, SessionId, bin(TimeGenerated, 10m)
| where DistinctIPs > 1
| project TimeGenerated, UserPrincipalName, SigninCount, IPs, ASNs
;

// Hunt: Newly registered or force-installed browser extensions via registry policy
DeviceRegistryEvents
| where TimeGenerated > ago(7d)
| where RegistryKey has_any (@"Chrome\Policy", @"Edge\Policy", "ExtensionInstallForcelist", "ExtensionSettings")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName,
    RegistryKey, RegistryValueName, RegistryValueData
| order by TimeGenerated desc

Velociraptor VQL

VQL — Velociraptor

-- Hunt artifact: enumerate installed Chromium extensions and flag high-risk permission scopes
-- Deploy across the fleet; review results for unvetted extensions with broad data access
SELECT FullPath AS ManifestPath,
       parse_json(data=read_file(filename=FullPath)) AS Manifest,
       parse_json(data=read_file(filename=FullPath)).name AS ExtensionName,
       parse_json(data=read_file(filename=FullPath)).permissions AS Permissions,
       parse_json(data=read_file(filename=FullPath)).host_permissions AS HostPermissions
FROM glob(globs=[
  'C:/Users/*/AppData/Local/Google/Chrome/User Data/*/Extensions/*/*/manifest.json',
  'C:/Users/*/AppData/Local/Microsoft/Edge/User Data/*/Extensions/*/*/manifest.json'
])
WHERE Permissions =~ 'cookies|webRequest|tabs|<all_urls>|declarativeNetRequest|nativeMessaging'
   OR HostPermissions =~ '\*://\*|<all_urls>'

Browser Hardening and Verification Script

The following PowerShell audits extension posture and enforces baseline Chromium policies that blunt the most common browser-borne techniques. Test in a pilot OU before broad rollout.

PowerShell

#Requires -RunAsAdministrator
# Browser hardening audit + enforcement for Chrome/Edge (domain or local policy)

$chromePolicy = 'HKLM:\SOFTWARE\Policies\Google\Chrome'
$edgePolicy   = 'HKLM:\SOFTWARE\Policies\Microsoft\Edge'

foreach ($path in @($chromePolicy, $edgePolicy)) {
    if (-not (Test-Path $path)) { New-Item -Path $path -Force | Out-Null }

    # Block third-party (non-store, sideloaded) extensions
    New-ItemProperty -Path $path -Name 'ExtensionInstallBlocklist' -PropertyType String -Value '*' -Force | Out-Null

    # Block incognito (forces observable, policy-enforced browsing for audit trails)
    New-ItemProperty -Path $path -Name 'IncognitoModeAvailability' -PropertyType DWord -Value 1 -Force | Out-Null

    # Enforce Safe Browsing enhanced protection
    New-ItemProperty -Path $path -Name 'SafeBrowsingProtectionLevel' -PropertyType DWord -Value 2 -Force | Out-Null

    # Disable password manager if you use an enterprise vault (reduces credential scrape target)
    New-ItemProperty -Path $path -Name 'PasswordManagerEnabled' -PropertyType DWord -Value 0 -Force | Out-Null

    # Block legacy IE-mode fallback abuse surface where not required
    New-ItemProperty -Path $path -Name 'BrowserGuestModeEnabled' -PropertyType DWord -Value 0 -Force | Out-Null
}

# Audit: inventory all installed extensions per user profile for review
$extPaths = @(
    "$env:LOCALAPPDATA\Google\Chrome\User Data\*\Extensions",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\*\Extensions"
)
$inventory = foreach ($base in $extPaths) {
    Get-ChildItem -Path $base -Directory -ErrorAction SilentlyContinue | ForEach-Object {
        [PSCustomObject]@{
            ExtensionID = $_.Name
            BrowserPath = $_.Parent.Parent.Name
            Versions    = (Get-ChildItem $_.FullName -Directory -ErrorAction SilentlyContinue).Name -join ','
        }
    }
}
$inventory | Sort-Object ExtensionID -Unique | Export-Csv "$env:TEMP\extension_inventory.csv" -NoTypeInformation
Write-Output "[+] Policies applied. Extension inventory exported to $env:TEMP\extension_inventory.csv"
Write-Output "[+] Review IDs against your approved extension allowlist; investigate any unknown entries."

Note: the blocklist/allowlist combination above blocks everything not explicitly permitted — pair it with an ExtensionInstallAllowlist containing your approved extension IDs before enforcing broadly, or you will break legitimate business extensions.

Remediation and Defensive Actions

Whether or not you license the new Falcon browser security capability, execute the following now:

Inventory your extension estate. Run the VQL hunt or PowerShell audit above fleet-wide. Build an approved extension allowlist; treat everything else as suspect until vetted. Extension compromise is a live supply-chain vector, and most organizations have never enumerated what is installed.
Deploy phishing-resistant MFA. Session-token theft via AiTM phishing defeats SMS, TOTP, and push-based MFA. Migrate priority users (admins, finance, executives) to FIDO2/passkeys or certificate-based authentication. This is the single highest-leverage control against the dominant browser-borne technique.
Enable token protection and conditional access. In Microsoft Entra, deploy Conditional Access token binding where available, require compliant-device conditions, and alert on impossible-travel and anomalous ASN sign-ins (the second KQL query above operationalizes this hunt).
Constrain browser execution behavior. The first Sigma rule — browser spawning script interpreters — should be deployed in every Windows environment. Alert volume is low and fidelity is high; treat every hit as investigation-worthy.
Harden browser policy via GPO/MDM. Apply the registry policy baseline above (or the Chrome/Edge ADMX equivalents): block third-party extensions, enforce Safe Browsing enhanced protection, disable guest mode, and disable the built-in password store if you operate an enterprise vault.
Evaluate the Falcon module against your gaps. If you are an existing Falcon customer, the consolidated telemetry argument is strong — browser events landing in the same console and detections pipeline removes a swivel-chair problem. Validate during trial that it covers your actual browser mix (Chrome, Edge, Firefox) and your remote/off-network population, which is exactly where network-layer controls fail.
Update user awareness content for AiTM realism. Modern phishing pages are pixel-perfect proxies of the real IdP login. Train users on the one reliable tell: the URL is not your identity provider's domain. Bookmark-driven access to critical SaaS portals should be policy, not suggestion.

Executive Takeaways

The browser is now the primary initial-access surface; security architecture built around email gateways and network proxies has a growing blind spot.
Session-token theft defeats most MFA — phishing-resistant authentication (FIDO2/passkeys) is a 2026 necessity, not a roadmap item.
Browser extensions are an unaudited supply chain inside your perimeter; inventory and allowlist them this quarter.
Consolidating browser telemetry into your existing EDR console (as Falcon now offers) reduces detection latency and analyst context-switching — evaluate it against your off-network coverage gaps specifically.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub