Browser writes .exe to disk with no corresponding .exe network download (in-browser PE assembly)
Detects instances where a web browser process creates a new executable file (.exe) in the 'Downloads' folder without a corresponding network connection event recorded by the browser to an executable URL. This pattern is indicative of potential in-browser assembly of a malicious file or an executable being dropped via non-standard browser download pathways, such as through local file system manipulation or hidden secondary processes.
Microsoft Sentinel (KQL)
