Process probes multiple ProgramFiles/LocalAppData paths for chrome.exe or msedge.exe
Detects processes attempting to interact with multiple browser binaries (chrome.exe or msedge.exe) across different standard application directories within a short time window. This behavior often indicates an adversary or malicious script probing for specific installed browsers to facilitate credential harvesting, configuration dumping, or session hijacking.
Microsoft Sentinel (KQL)
