Suspicious File Creation by Browser or Email Client

nomit vyas@xoxo

•updated Jun 24, 2026•1•0•3

Detects the creation of executable or script files by common web browsers (Chrome, Firefox, Edge, Internet Explorer) or email clients (Outlook). This activity can indicate a drive-by download, a malicious attachment being saved, or other forms of initial access where an attacker leverages a user's interaction with these applications to drop malicious payloads.