Suspicious VHD Image Download Through Browser (via file_event)

title: Suspicious VHD Image Download Through Browser (via file_event)
id: d96f58e9-2c5c-574b-a8de-730cbc07c023
status: stable
description: This rule detects creation of ".vhd"/".vhdx" files by browser processes. Malware can use mountable Virtual Hard Disk ".vhd" files to encapsulate payloads and evade security controls.
references:
    - https://attack.mitre.org/techniques/T1587/001/
    - https://redcanary.com/blog/intelligence-insights-october-2021/
    - https://www.kaspersky.com/blog/lazarus-vhd-ransomware/36559/
    - https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/
author: Huntrule Team
date: 2026-07-03
tags:
    - attack.resource-development
    - attack.t1587.001
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith:
            - '\brave.exe'
            - '\chrome.exe'
            - '\firefox.exe'
            - '\iexplore.exe'
            - '\maxthon.exe'
            - '\MicrosoftEdge.exe'
            - '\msedge.exe'
            - '\msedgewebview2.exe'
            - '\opera.exe'
            - '\safari.exe'
            - '\seamonkey.exe'
            - '\vivaldi.exe'
            - '\whale.exe'
        TargetFilename|contains: '.vhd'
    condition: selection
falsepositives:
    - Unknown
level: medium