detection.wiki

Detection rules › Sigma

File Download From Browser Process Via Inline URL

Severity
medium
Author
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Source
upstream

Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension. This can be abused to download arbitrary files or to hide from the user for example by launching the browser in a minimized state.

MITRE ATT&CK coverage

TacticTechniques
Command & ControlT1105 Ingress Tool Transfer

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation
Security-Auditing4688A new process has been created.

Stages and Predicates

Stage 1: all of selection_img

or:
Image|endswith: '\brave.exe'
Image|endswith: '\chrome.exe'
Image|endswith: '\msedge.exe'
Image|endswith: '\opera.exe'
Image|endswith: '\vivaldi.exe'

Stage 2: all of selection_http

CommandLine|contains: http

Stage 3: all of selection_extensions

or:
CommandLine|endswith: .7z
CommandLine|endswith: .dat
CommandLine|endswith: .dll
CommandLine|endswith: .exe
CommandLine|endswith: .hta
CommandLine|endswith: .ps1
CommandLine|endswith: .psm1
CommandLine|endswith: .txt
CommandLine|endswith: .vbe
CommandLine|endswith: .vbs
CommandLine|endswith: .zip
CommandLine|contains: '.7z"'
CommandLine|contains: '.dat"'
CommandLine|contains: '.dll"'
CommandLine|contains: '.hta"'
CommandLine|contains: '.ps1"'
CommandLine|contains: '.psm1"'
CommandLine|contains: '.txt"'
CommandLine|contains: '.vbe"'
CommandLine|contains: '.vbs"'
CommandLine|contains: '.zip"'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLineends_with
  • .7z
  • .dat corpus 7 (sigma 7)
  • .dll corpus 9 (sigma 9)
  • .exe corpus 6 (sigma 6)
  • .hta corpus 6 (sigma 6)
  • .ps1 corpus 6 (sigma 6)
  • .psm1 corpus 6 (sigma 6)
  • .txt corpus 3 (sigma 3)
  • .vbe corpus 7 (sigma 7)
  • .vbs corpus 7 (sigma 7)
  • .zip
CommandLinematch
  • .7z"
  • .dat"
  • .dll" corpus 2 (sigma 2)
  • .hta"
  • .ps1"
  • .psm1"
  • .txt"
  • .vbe"
  • .vbs"
  • .zip"
  • http corpus 31 (sigma 31)
Imageends_with
  • \brave.exe corpus 20 (sigma 20)
  • \chrome.exe corpus 11 (sigma 11)
  • \msedge.exe corpus 22 (sigma 22)
  • \opera.exe corpus 21 (sigma 21)
  • \vivaldi.exe corpus 19 (sigma 19)

Neighbors

Stricter alternatives (narrower than this rule)

The rules below may be useful if you find the current rule is too noisy / lacks specificity.