Suspicious Web Browser Launch from PDF/Office Reader on Windows over HTTP(S)

Alerts when Acrobat/Office/PDF readers launch common browsers with HTTP(S) URLs, excluding known Microsoft and Foxit redirect patterns.

FreeUnreviewedSigmamediumv1

suspicious-web-browser-launch-from-pdf-office-reader-on-windows-over-http-s-1193d960

title: Suspicious Web Browser Launch from PDF/Office Reader on Windows over HTTP(S)
id: 668a46e5-c93a-4fad-9714-e48663826afa
status: test
description: This rule flags Windows process creations where a PDF or Office document reader spawns a web browser binary and the browser command line includes the string "http". Such activity can indicate phishing or link-driven payload delivery from a document-rendering context. It relies on process creation telemetry, including parent process image names, child browser executable names, and the child command line content. It excludes cases involving Microsoft help redirect links and specific Foxit service tracking/redirect URLs.
references:
  - https://app.any.run/tasks/69c5abaa-92ad-45ba-8c53-c11e23e05d04/
  - https://app.any.run/tasks/64043a79-165f-4052-bcba-e6e49f847ec1/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_browser_launch_from_document_reader_process.yml
author: Joseph Kamau, Huntrule Team
date: 2024-05-27
modified: 2025-10-07
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|contains:
      - Acrobat Reader
      - Microsoft Office
      - PDF Reader
    Image|endswith:
      - \brave.exe
      - \chrome.exe
      - \firefox.exe
      - \msedge.exe
      - \opera.exe
      - \maxthon.exe
      - \seamonkey.exe
      - \vivaldi.exe
    CommandLine|contains: http
  filter_main_microsoft_help:
    CommandLine|contains: https://go.microsoft.com/fwlink/
  filter_optional_foxit:
    CommandLine|contains:
      - http://ad.foxitsoftware.com/adlog.php?
      - https://globe-map.foxitservice.com/go.php?do=redirect
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unlikely in most cases, further investigation should be done in the commandline of the browser process to determine the context of the URL accessed.
level: medium
license: DRL-1.1
related:
  - id: 1193d960-2369-499f-a158-7b50a31df682
    type: derived

What it detects

This rule flags Windows process creations where a PDF or Office document reader spawns a web browser binary and the browser command line includes the string "http". Such activity can indicate phishing or link-driven payload delivery from a document-rendering context. It relies on process creation telemetry, including parent process image names, child browser executable names, and the child command line content. It excludes cases involving Microsoft help redirect links and specific Foxit service tracking/redirect URLs.

Known false positives

Unlikely in most cases, further investigation should be done in the commandline of the browser process to determine the context of the URL accessed.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.