heroui logo

Windows Chromium Process Launched with Logging Disabled

Splunk Security Content

View Source
Summary
This detection rule identifies instances in which Chromium-based browser processes—like Chrome, Brave, Opera, Vivaldi, and Microsoft Edge—are launched on Windows systems with logging disabled through specific command-line flags such as --disable-logging and --disable-logging-redirect. These flags are typically associated with development or testing environments where logging may not be useful. However, their presence in production environments can indicate attempts by malware or malicious scripts to evade security monitoring by disabling logging functionalities. The rule utilizes data from Sysmon EventID 1, Windows Security logs, and CrowdStrike to detect such behavior across different processes and demands examination of the command-line arguments, parent process, and execution context to ascertain whether the activity is benign or suspicious. Analysts are encouraged to investigate any instances of browsers being launched under these conditions further to help mitigate potential threats.
Categories
  • Endpoint
Data Sources
  • Process
  • Windows Registry
  • Windows Registry
ATT&CK Techniques
  • T1497
Created: 2026-01-23