Notifications
Clear all
Topic starter
24/07/2026 4:07 pm
TL;DR: A browser-session telemetry and technique-level intelligence approach is becoming more important than IOC-heavy workflows for stopping modern attacks pre-compromise, according to Push Security. Its agentic threat-hunting pipeline has tripled new detections this year, cut production-ready detection time from weeks to minutes, and now runs 300-plus hunts a month across 10,000-plus monthly sessions.
NHIMG editorial — based on content published by Push Security: agentic browser hunting and pre-compromise detections
By the numbers:
- We perform an average of 300+ hunts a month.
- We protected 60+ customers in the last 3 months who have been targeted with novel phishing techniques.
Questions worth separating out
Q: How should security teams turn threat intelligence into browser detections?
A: Start by extracting behavioral patterns that are visible in browser sessions, then validate them against your own telemetry before turning them into production rules.
Q: Why do browser attacks create blind spots for identity teams?
A: Because many identity-related attacks begin in the browser before they appear as authentication events.
Q: What do security teams get wrong about IOC-led detection engineering?
A: They often assume a larger blocklist equals better defense, but browser attackers can rotate infrastructure faster than teams can curate indicators.
Practitioner guidance
- Instrument browser-session telemetry for attack reconstruction Capture tabs, navigation events, downloads, script execution, DOM content, and network requests so detection logic can see the session where phishing and OAuth abuse actually occur.
- Convert TI into technique signatures, not IOC lists Use threat reports to extract behavioral patterns that survive domain rotation and trusted-service abuse, then write detections around those patterns instead of static indicators.
- Build a refinement loop for false-positive reduction Test each proposed hunt against your own telemetry, narrow the query until legitimate browser activity is excluded, and promote only high-fidelity patterns into production detections.
What's in the full article
Push Security's full article covers the operational detail this post intentionally leaves for the source:
- The step-by-step agentic pipeline for ingesting threat intelligence, extracting huntable browser behaviors, and refining detections across a large install base.
- The internal knowledge-base logic used to classify whether a technique is net-new, a variant, or already covered.
- The live examples of ConsentFix, InstallFix, and LLMShare and how those browser techniques were validated.
- The metrics behind the reduction from weeks to minutes in shipping production-ready detections.
👉 Read Push Security's analysis of agentic browser hunting and pre-compromise detections →
Agentic browser hunting: what it means for detection teams?
Explore further
24/07/2026 4:12 pm
Technique-level detection is now the right unit of defense for browser attacks. Static IOCs age out quickly, but attacker behaviors in the browser session are harder to change without breaking the campaign itself. That makes browser telemetry a more durable source for detection engineering than blocklists or isolated TI notes. For practitioners, the strategic shift is from chasing infrastructure to identifying reusable behavioral patterns.
A question worth separating out:
Q: How can teams reduce false positives in browser-based detections?
A: Validate each candidate detection against legitimate browsing patterns, then tighten the logic until ordinary tab activity, downloads, and network requests no longer match. The goal is not maximum alert volume. It is high-confidence technique coverage that can be promoted safely into production.
👉 Read our full editorial: Agentic threat hunting in the browser is changing detection engineering
