Arbitrary File Download Via MSOHTMED.EXE
This rule detects the execution of 'MSOHTMED.exe' when its command line contains URL indicators such as 'ftp://', 'http://', or 'https://'. MSOHTMED.exe is a legitimate Microsoft Office component (HTML Editor) that can be abused to download arbitrary files from the internet, acting as a living-off-the-land binary (LOLBIN). This behavior can be used by adversaries for defense evasion and execution of malicious content.
Sigma
