huntrule

Web Browser Opens .HTM/.HTML from Downloads Folder on Windows

Flags browser processes opening .htm files from a user’s Downloads folder on Windows, a pattern consistent with HTML attachment activity.

FreeReviewedSigma · Low · v5
Product
windows
Category
process_creation
Author
Joseph Kamau (SigmaHQ), DRL 1.1
Published
2025-12-05
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Recon → Initial Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags when common web browsers (Chrome, Firefox, Edge, Opera, Brave, Vivaldi) launch with command-line parameters indicating an HTML file (containing .htm) located under the user Downloads directory. Attackers may use HTML attachments or links to deliver malicious content and drive follow-on actions once opened by the browser. It relies on Windows process creation telemetry capturing the browser executable and its command line, including the Downloads path and file extension.

Reporting behind it

Related detections9 linkedT1566.001 — drag to rearrange
Suspicious mstsc Launch of RDP File From User Download or Temp Path (via process_creation)
Suspicious Regsvr32 Squiblydoo Remote Scriptlet Execution via Command Line (via process_creation)
Possible Mamba 2FA AiTM Phishing URL Pattern
Suspicious DLL Written to Explorer IconCache Path
Suspicious DNS Query to HTML Smuggling AiTM Phishing Domain
Malicious Microsoft Word Spawning Anomalous Child Process via CVE-2023-36884 (via process_creation)
Malicious Equation Editor Child Process Execution via process_creation
Microsoft 365 inbound suspicious email delivered to Inbox or Junk
Windows: Suspicious Attachment File Created in Outlook Temp Directories
Web Browser Opens .HTM/.HTML from Downloads Folder on Windows
Pivot detection · T1566.001 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.