Browser Initiated File Download Detection
This rule identifies file download events initiated by common web browsers such as Microsoft Edge, Internet Explorer, Google Chrome, and Mozilla Firefox. It can be used for hunting suspicious file downloads on devices, especially after an incident alert, or for general threat hunting.
Microsoft Sentinel (KQL)
