File Download From Browser Process Via Inline URL

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•12

Detects the execution of common browser processes (Brave, Chrome, Edge, Opera, Vivaldi) with a command-line argument containing a URL that points to a file with a potentially interesting extension. This behavior can be abused by adversaries to download arbitrary files, potentially for further execution or to hide malicious activity by launching the browser in a minimized state.