This analytic detects a Chromium-based browser being launched with both the --hide-crash-restore-bubble and --restore-last-session command-line flags by a process other than the browser itself. It focuses on browser command lines that silently restore the previous session without showing the typical crash notification, which is a behavior commonly used by browser hijackers and adware droppers to tamper with profile data (e.g., default search engine, new tab page, or extensions) and then relaunch the browser so the user does not notice. When triggered, the rule indicates that a non-browser parent process started a browser process (chrome.exe, msedge.exe, or brave.exe) with the two flags, potentially signaling an attacker-controlled session or page. The detection relies on endpoint telemetry from EDRs (Sysmon EventID 1, Windows Security Log 4688, and CrowdStrike ProcessRollup2) and normalizes data into the Endpoint Processes model. It filters for browser process names and command lines containing both flags, while ensuring the parent process is not one of the browser executables. This is mapped to MITRE ATT&CK technique T1176.001 (Browser Hijacking) and aligns with the rule’s analytic story of Browser Hijacking. The resulting finding describes a silent browser session restoration initiated by a specific process on a given host for a given user, consistent with potential tampering or redirection of browser state. Known false positives include legitimate enterprise tooling or support processes that launch a browser with these flags to restore sessions silently; such cases should be filtered by parent-process and context. Overall, the rule provides visibility into attempts to covertly restore browser sessions and tamper with browser state, enabling timely alerts and investigation of possible hijacking or extension abuse.