Arbitrary File Download Via PresentationHost.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

Detects the use of 'PresentationHost.exe', a utility designed to run '.xbap' (Browser Applications) files, when it attempts to download arbitrary files from HTTP, HTTPS, or FTP sources. This behavior can be abused for defense evasion and execution of malicious content.