Threat Huntlowexperimental

HTML File Opened From Download Folder

Detects web browser process opening an HTML file from a user's Downloads folder. This behavior is could be associated with phishing attacks where threat actors send HTML attachments to users. When a user opens such an attachment, it can lead to the execution of malicious scripts or the download of malware. During investigation, analyze the HTML file for embedded scripts or links, check for any subsequent downloads or process executions, and investigate the source of the email or message containing the attachment.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Joseph KamauCreated Fri Dec 05538c5851-8c03-4724-8ec4-623bc7aadaeawindows
Hunting Hypothesis
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        Image|endswith:
            - '\brave.exe'
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
            - '\opera.exe'
            - '\vivaldi.exe'
        CommandLine|contains|all:
            - ':\users\'
            - '\Downloads\'
            - '.htm'
    condition: selection
False Positives

Opening any HTML file located in users directories via a browser process will trigger this.

Rule Metadata
Rule ID
538c5851-8c03-4724-8ec4-623bc7aadaea
Status
experimental
Level
low
Type
Threat Hunt
Created
Fri Dec 05
Path
rules-threat-hunting/windows/process_creation/proc_creation_win_susp_open_html_file_from_download_folder.yml
Raw Tags
attack.t1598.002attack.t1566.001attack.initial-accessattack.reconnaissancedetection.threat-hunting
View on GitHub