Html Smuggling File Creation By Browser
Detects when a web browser process creates a high-risk file type (e.g., ISO, ZIP, EXE). This behavior is a strong indicator of HTML smuggling (T1027.006), where a malicious payload is decoded from an HTML file and written to disk by the browser itself to evade network security.
YARA-L
