File Download From Browser Process Via Inline URL

SigmaHQ Detections@sigmaHQ

•updated Nov 26, 2025•0•0•0

Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension. This can be abused to download arbitrary files or to hide from the user for example by launching the browser in a minimized state.