Browser-Triggered Suspicious File Creation via Sysmon

Siva prasad@sivaprasad

•updated Dec 28, 2025•4•0•86

Detects suspicious file creations in temporary or user application data directories immediately following browser process activities, indicating potential injected content saved to disk. Aligns with MITRE DET0349 guidance.