Browser Initiated Script or Executable Execution

Ankit Mehta@Secvyn

•updated Jun 5, 2026•1•0•6

This rule detects when a web browser initiates the execution of an executable (.exe), dynamic link library (.dll), JavaScript (.js), or VBScript (.vbs) file. This behavior can be indicative of malicious activity such as drive-by downloads, phishing attacks leading to malware execution, or exploitation of browser vulnerabilities.