Potential Suspicious Browser Launch From Document Reader Process

SigmaHQ Detections@sigmaHQ

•updated Oct 9, 2025•0•13

Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc., and connects to a web application over http(s). This could indicate a possible phishing attempt, where a malicious document is used to redirect a user to a malicious website.