User-Driven Download of Potentially Malicious File Type

Kenji Choy@kchoy

•updated Jan 12, 2026•8•0•116

This query detects when a user downloads a potentially malicious or unauthorized file type (e.g., executable, script, archive) from the internet using a web browser. It leverages endpoint file creation events from data mapped to the Elastic Common Schema (ECS).