Describe the behaviour you want to detect. SARA writes a starting Sigma rule with MITRE tags, false-positive guidance, and detection-engineering context. Anonymous, no account, best-effort generic detection.
title: Suspicious Child Process of Web Browser - CVE-2021-30551 Pattern
id: 50175057-046b-4191-b1fd-e963a4249ffd
status: experimental
description: >
Detects suspicious child processes spawned by modern web browsers (Chrome, Edge, Chromium).
This behavior is indicative of a sandbox escape following a browser exploitation attempt,
such as CVE-2021-30551 (V8 Type Confusion, CISA KEV-listed). Attackers use this to execute
shellcode or launch secondary payloads after compromising the browser's renderer process.
CVSS: 8.8 (High). KEV Status: Exploited in the wild.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2021-30551
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://googleprojectzero.blogspot.com/2021/07/in-the-wild-series-chrome-infinity-bug.html
author: SARA Detection Engineering
date: 2026-08-18
tags:
- attack.execution
- attack.t1059
- attack.t1059.001
- attack.t1059.003
- attack.t1204.002
- attack.t1185
logsource:
category: process_creation
product: windows
detection:
selection_browser_parent:
ParentImage|endswith:
- '\chrome.exe'
- '\msedge.exe'
- '\brave.exe'
- '\opera.exe'
- '\vivaldi.exe'
- '\chromium.exe'
selection_susp_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\csc.exe'
- '\mshta.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\regsvr32.exe'
- '\rundll32.exe'
- '\certutil.exe'
- '\bitsadmin.exe'
filter_legitimate_extensions:
# Exclude common browser-launched update mechanisms that might spawn cmd/powershell
ParentCommandLine|contains:
- '\Google\Chrome\Application\chrome.exe'
- '\Microsoft\Edge\Application\msedge.exe'
CommandLine|contains:
- '--update'
- '--install'
- '--verify-age'
condition: selection_browser_parent and selection_susp_child and not filter_legitimate_extensions
falsepositives:
- Legitimate browser extensions or enterprise management tools that spawn command-line utilities
- Browser self-update mechanisms (e.g., Google Update)
- Enterprise DLP or security agents injecting into browser processes
level: high
Sigma is the open, vendor-neutral format for log-based detections. One rule, written once, converts to Splunk SPL, Elastic ES|QL, KQL for Microsoft Sentinel, Sumo, Chronicle, QRadar, and more. Detection engineers love it for the same reason ATT&CK is the lingua franca for tactics — Sigma is the lingua franca for the queries that detect them.
You've got a fresh write-up of a TTP and need a starting detection in your stack today. Generate, tune, ship.
Pair-program with SARA: the generator produces the skeleton, the engineer learns by tuning, the team commits the result.
You have a rule in one query language; describe it in English and get the Sigma version + conversions to every other backend.
Sketch a detection idea in 30 seconds before investing in a full DE sprint.
SARA Open ships an OpenAI-compatible API. Call POST /api/v1/sigma — Plain English in, valid Sigma YAML out, with MITRE tags and false-positive guidance.
curl -X POST https://sara-open.sirp.io/api/v1/sigma \
-H "Authorization: Bearer $SARA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"description": "PowerShell encoded command from Office"}'
Read the API reference →