In-Memory Malware Assembly via Malvertising: Defense Against Fileless Browser Attacks

---
title: Suspicious Process Spawn from Browser
id: 8a4b2c1d-6e8f-4a3b-9c1d-2e4f6a8b0c1d
status: experimental
description: Detects browsers spawning suspicious child processes like cmd, powershell, or script hosts, indicative of successful exploit or fileless malware execution.
references:
 - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.execution
 - attack.t1059.003
 - attack.t1059.001
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   ParentImage|endswith:
     - '\chrome.exe'
     - '\msedge.exe'
     - '\firefox.exe'
     - '\opera.exe'
   Image|endswith:
     - '\cmd.exe'
     - '\powershell.exe'
     - '\pwsh.exe'
     - '\wscript.exe'
     - '\cscript.exe'
     - '\mshta.exe'
 condition: selection
falsepositives:
 - Legitimate browser extensions launching utilities (rare)
 - Administrator debugging
level: high
---
title: Browser Spawning Unsigned Executable from User Directory
id: 9c5d3e2f-7f9a-5b4c-0d2e-3f5a7b9c1d2e
status: experimental
description: Detects browsers spawning executables from user profile directories (AppData/Temp) which are often used as drop locations for malware assembled in memory.
references:
 - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.initial_access
 - attack.t1204
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   ParentImage|endswith:
     - '\chrome.exe'
     - '\msedge.exe'
     - '\firefox.exe'
   Image|contains:
     - '\AppData\Local\Temp\'
     - '\AppData\Roaming\'
 filter_legit:
   Image|contains:
     - '\Google\Chrome\Application\'
     - '\Microsoft\Edge\Application\'
 condition: selection and not filter_legit
falsepositives:
 - Browser auto-updates (usually signed and in specific subdirs)
 - User-initiated downloads (if allowed by policy)
level: medium
---
title: Potential Malvertising Network Connection
id: 1d4e5f6a-0a1b-2c3d-4e5f-6a7b8c9d0e1f
status: experimental
description: Detects outbound connections from browsers to domains containing keywords for targeted brands (solana, luno, tradingview) on suspicious TLDs often used in malvertising.
references:
 - https://attack.mitre.org/techniques/T1189/
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.initial_access
 - attack.t1189
logsource:
 category: network_connection
 product: windows
detection:
 selection_keywords:
   DestinationHostname|contains:
     - 'solana'
     - 'luno'
     - 'tradingview'
 selection_tld:
   DestinationHostname|endswith:
     - '.xyz'
     - '.top'
     - '.click'
     - '.tk'
   Initiated: 'true'
 condition: all of selection_*
falsepositives:
 - Legitimate affiliate links (rare on these TLDs)
level: low

// Hunt for suspicious child processes spawned by browsers
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "opera.exe")
// Exclude common legitimate browser helper processes and updaters
| where not(ProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "runtimebroker.exe", "conhost.exe", " WerFault.exe"))
| where ProcessCommandLine != "" 
| where FolderPath contains "\\AppData\\" or FolderPath contains "\\Temp\\"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessFileName, ProcessCommandLine, FolderPath, SHA256
| order by Timestamp desc

-- Hunt for processes spawned by browsers that are not themselves browser instances
SELECT Pid, Name, CommandLine, Exe, Username, Ppid
FROM pslist()
WHERE Ppid IN (
    SELECT Pid FROM pslist() WHERE Name =~ "chrome|msedge|firefox|opera"
)
AND NOT Name =~ "chrome|msedge|firefox|opera|crashpad_handler|gpu_process|utility_process"

# Incident Response Script: Audit Browser Processes
# Run this on endpoints to identify suspicious activity related to browser memory exploitation

Write-Host "[+] Auditing active browser processes and children..." -ForegroundColor Cyan

$Browsers = @("chrome", "msedge", "firefox", "opera")
$SuspiciousChildren = @()

Get-WmiObject Win32_Process | ForEach-Object {
    $Parent = $_
    if ($Browsers -contains $Parent.Name.Split('.')[0]) {
        $Children = Get-WmiObject Win32_Process | Where-Object { $_.ParentProcessId -eq $Parent.ProcessId }
        
        foreach ($Child in $Children) {
            # Check for non-browser child processes
            if ($Browsers -notcontains $Child.Name.Split('.')[0]) {
                $Details = [PSCustomObject]@{
                    BrowserPID   = $Parent.ProcessId
                    BrowserName  = $Parent.Name
                    ChildPID     = $Child.ProcessId
                    ChildName    = $Child.Name
                    ChildPath    = $Child.ExecutablePath
                    CommandLine  = $Child.CommandLine
                }
                $SuspiciousChildren += $Details
            }
        }
    }
}

if ($SuspiciousChildren.Count -gt 0) {
    Write-Host "[!] WARNING: Detected suspicious child processes spawned by browsers:" -ForegroundColor Red
    $SuspiciousChildren | Format-Table -AutoSize
    
    # Optional: Kill suspicious processes (Uncomment to enforce)
    # foreach ($proc in $SuspiciousChildren) {
    #     Write-Host "[+] Terminating process $($proc.ChildName) (PID: $($proc.ChildPID))"
    #     Stop-Process -Id $proc.ChildPID -Force
    # }
} else {
    Write-Host "[+] No suspicious browser child processes detected." -ForegroundColor Green
}