Malicious Browser-Initiated Clipboard Paste Execution

Ankit Mehta@Secvyn

•updated Jun 26, 2026•2•0•4

This rule detects suspicious command-line execution originating from common web browsers. It identifies instances where a browser process launches a command-line interpreter (cmd, powershell, or wscript) and immediately invokes known download or utility commands (curl, iwr, bitsadmin, certutil), which is a common pattern for file-less or stage-two payload delivery from malicious websites.