Browser-in-the-browser (BitB)

Fake SSO pop-up window rendered in HTML/CSS inside the phishing page

categorySocial engineering and human-targeted attacksseverityHighdetectability (measured in our lab)Lowlabpartially detected

Example: mr.d0x (2022)

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1566.002 · Paste and run technique · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1566.002 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1566.002 -TestGuids bc177ef9-6a12-4ebc-a2ec-d41e19c2791d -TimeoutSeconds 120'

ATT&CK T1566.002 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1566.002 -Tool atomic -RunId run-2026-10-14-027 -Command 'Invoke-AtomicTest T1566.002 -TestGuids bc177ef9-6a12-4ebc-a2ec-d41e19c2791d -TimeoutSeconds 120'

ATT&CK T1566.002 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1566.002 -Tool atomic -RunId run-2026-10-18-010 -Command 'Invoke-AtomicTest T1566.002 -TestGuids bc177ef9-6a12-4ebc-a2ec-d41e19c2791d -TimeoutSeconds 120'

+ 2 more test variant(s) in the corpus.

What our lab measured

partially detected windows · 2026-10-28

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Powershell.exe spawned a powershell process which executed a base64 encoded command
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104	Powershell script searching filesystem
PowerShell · EID 4104	Powershell script used "Invoke-command" cmdlet to execute sub script
Security · EID 4624	Non network or service local logon.
Security · EID 4634	Non service account logged off.
… and 3 more event type(s)

Plus 11 stock Wazuh/Sysmon rule(s) in the window.

⚠ Gap: rule 100405 was expected but did not fire in this run — the telemetry above is the hunt surface, not a solved detection.

Background noise in the window: ~62981 incidental alerts/hour — tune against this.

partially detected windows · 2026-10-27

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Powershell.exe spawned a powershell process which executed a base64 encoded command
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104	Powershell script searching filesystem
PowerShell · EID 4104	Powershell script used "Invoke-command" cmdlet to execute sub script
Security · EID 4624	Non network or service local logon.
Security · EID 4634	Non service account logged off.
… and 3 more event type(s)

Plus 11 stock Wazuh/Sysmon rule(s) in the window.

⚠ Gap: rule 100405 was expected but did not fire in this run — the telemetry above is the hunt surface, not a solved detection.

Background noise in the window: ~67275 incidental alerts/hour — tune against this.

Classification

29 values: 2 lab-measured, 13 imported, 1 derived, 13 machine-classified. What do these mean?

Exploitability

Attack vector	Social engineering
Reach (CVSS)	Social
Attack complexity	Low
Privileges required	None
User interaction	Active
Attacker skill required	Medium
Resources required	Low
Likelihood / prevalence	Medium
Maturity	Emerging

Impact & scope

Severity	High
Impact	Confidentiality
Platform	Identity ProviderLinuxmacOSOffice SuiteSaaSWindows
Environment	Cloud
Target asset class	HumanIdentity
Kill-chain phase (tactic)	Initial Access

Detection & telemetry

Detectability (measured in our lab)	Low
Detectability (public detection content)	High
Noise level	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Application Log ContentNetwork Connection CreationNetwork Traffic ContentNetwork Traffic FlowProcess Creation

Detection & response

Mitigated by 39

M1017 attack-mitigation
M1018 attack-mitigation
M1021 attack-mitigation
M1047 attack-mitigation
M1054 attack-mitigation
D3-APCA d3fend
D3-CF d3fend
D3-CM d3fend
D3-CQ d3fend
D3-CSPP d3fend
D3-DA d3fend
D3-DF d3fend
D3-DI d3fend
D3-EF d3fend
D3-EFA d3fend
D3-ER d3fend
D3-FA d3fend
D3-FE d3fend
D3-FEV d3fend
D3-FIM d3fend
D3-HD d3fend
D3-IAA d3fend
D3-ISVA d3fend
D3-ITF d3fend
D3-LFP d3fend
D3-NTCD d3fend
D3-NTF d3fend
D3-NTSA d3fend
D3-PHDURA d3fend
D3-PMAD d3fend
D3-RE d3fend
D3-RF d3fend
D3-RFAM d3fend
D3-RTSD d3fend
D3-SMRA d3fend
D3-SRA d3fend
D3-UA d3fend
D3-UGLPA d3fend
D3-URA d3fend

Detected by 5

DET0107 attack-detection-strategy
3569aefd-e535-4391-8c18-24bd01a21eaf sigma
38e7f511-3f74-41d4-836e-f57dfa18eead sigma
6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4 sigma
e0e121d0-be4d-4281-af7e-17abbba4a408 sigma

Tested by 1

bc177ef9-6a12-4ebc-a2ec-d41e19c2791d atomic

Attack relationships

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

Run	Outcome	Tool	Platform	Ran at
`run-2026-10-14-027`	partially-detected	atomic	windows	2026-10-14
`run-2026-10-18-010`	partially-detected	atomic	windows	2026-10-18
`run-2026-10-27-027`	partially-detected	atomic	windows	2026-10-27
`run-2026-10-28-021`	partially-detected	atomic	windows	2026-10-28

run-2026-10-14-027 — Backlog detectability-baseline probe (priority 5, 5 corpus attack(s); atomic_tests=1). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1566.002 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=18 max_level=15 dwell_s=90
run-2026-10-18-010 — Backlog detectability-baseline probe (priority 5, 5 corpus attack(s); atomic_tests=1). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1566.002 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1527 max_level=15 dwell_s=90
run-2026-10-27-027 — Backlog detectability-baseline probe (priority 5, 5 corpus attack(s); atomic_tests=1). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1566.002 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1794 max_level=15 dwell_s=90
run-2026-10-28-021 — Backlog detectability-baseline probe (priority 5, 5 corpus attack(s); atomic_tests=1). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1566.002 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1697 max_level=15 dwell_s=90

Framework references

Primary source: https://www.kaspersky.com/blog/browser-in-the-browser-attack/44163/
attack: T1566.002 (primary)

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Social engineering and human-targeted attacks' table, line 47 of Cyber-Attack-Taxonomy.md
ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1566.002 as the nearest framework entries; ids verified to exist in the cached catalogues.
ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 86 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0004 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-027 (partially-detected) for T1566.002: no alert matched the expected technique
ev-0005 (Phase 4 detection lab - detonation runs 2026-10-18) — Lab detonation run-2026-10-18-010 (partially-detected) for T1566.002: no alert matched the expected technique
ev-0006 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-027 (partially-detected) for T1566.002: no alert matched the expected technique
ev-0007 (Phase 4 detection lab - detonation runs 2026-10-28) — Lab detonation run-2026-10-28-021 (partially-detected) for T1566.002: no alert matched the expected technique