Suspicious Web Browser Launch from PDF/Office Reader on Windows over HTTP(S)
Alerts when Acrobat/Office/PDF readers launch common browsers with HTTP(S) URLs, excluding known Microsoft and Foxit redirect patterns.
- Product
- windows
- Category
- process_creation
- Author
- Joseph Kamau (SigmaHQ), DRL 1.1
- Published
- 2024-05-27
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creations where a PDF or Office document reader spawns a web browser binary and the browser command line includes the string "http". Such activity can indicate phishing or link-driven payload delivery from a document-rendering context. It relies on process creation telemetry, including parent process image names, child browser executable names, and the child command line content. It excludes cases involving Microsoft help redirect links and specific Foxit service tracking/redirect URLs.
Reporting behind it
- app.any.runhttps://app.any.run/tasks/69c5abaa-92ad-45ba-8c53-c11e23e05d04/
- app.any.runhttps://app.any.run/tasks/64043a79-165f-4052-bcba-e6e49f847ec1/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_browser_launch_from_document_reader_process.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Suspicious Web Browser Launch from PDF/Office Reader on Windows over HTTP(S)
id: 668a46e5-c93a-4fad-9714-e48663826afa
status: test
description: This rule flags Windows process creations where a PDF or Office document reader spawns a web browser binary and the browser command line includes the string "http". Such activity can indicate phishing or link-driven payload delivery from a document-rendering context. It relies on process creation telemetry, including parent process image names, child browser executable names, and the child command line content. It excludes cases involving Microsoft help redirect links and specific Foxit service tracking/redirect URLs.
references:
- https://app.any.run/tasks/69c5abaa-92ad-45ba-8c53-c11e23e05d04/
- https://app.any.run/tasks/64043a79-165f-4052-bcba-e6e49f847ec1/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_browser_launch_from_document_reader_process.yml
author: Joseph Kamau, Huntrule Team
date: 2024-05-27
modified: 2025-10-07
tags:
- attack.execution
- attack.t1204.002
logsource:
product: windows
category: process_creation
detection:
selection:
ParentImage|contains:
- Acrobat Reader
- Microsoft Office
- PDF Reader
Image|endswith:
- \brave.exe
- \chrome.exe
- \firefox.exe
- \msedge.exe
- \opera.exe
- \maxthon.exe
- \seamonkey.exe
- \vivaldi.exe
CommandLine|contains: http
filter_main_microsoft_help:
CommandLine|contains: https://go.microsoft.com/fwlink/
filter_optional_foxit:
CommandLine|contains:
- http://ad.foxitsoftware.com/adlog.php?
- https://globe-map.foxitservice.com/go.php?do=redirect
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Unlikely in most cases, further investigation should be done in the commandline of the browser process to determine the context of the URL accessed.
level: medium
license: DRL-1.1
related:
- id: 1193d960-2369-499f-a158-7b50a31df682
type: derived