Windows Browser Process Opens HTML from Downloads Folder

title: Windows Browser Process Opens HTML from Downloads Folder
id: fbeb2755-30b9-4d67-a4b1-ac86e24de2e4
status: experimental
description: This rule identifies instances where a web browser process (Chrome, Firefox, Edge, Brave, Opera, or Vivaldi) opens an HTML file located under the user’s Downloads directory. Such activity is important because attackers commonly deliver HTML attachments via messages and rely on the opened content to lead to malicious scripts or further payload downloads. It relies on Windows process creation telemetry, specifically browser process command lines containing the Downloads path and an .htm/.html extension.
references:
  - https://app.any.run/tasks/ae3c4ded-fd6a-43ed-8215-ba0ba574ad33
  - https://app.any.run/tasks/8901e2d5-0c5a-48ba-a8e9-10b5ed7e06f4
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_open_html_file_from_download_folder.yml
author: Joseph Kamau, Huntrule Team
date: 2025-12-05
tags:
  - attack.t1598.002
  - attack.t1566.001
  - attack.initial-access
  - attack.reconnaissance
  - detection.threat-hunting
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith:
      - \brave.exe
      - \chrome.exe
      - \firefox.exe
      - \msedge.exe
      - \opera.exe
      - \vivaldi.exe
    CommandLine|contains|all:
      - :\users\
      - \Downloads\
      - .htm
  condition: selection
falsepositives:
  - Opening any HTML file located in users directories via a browser process will trigger this.
level: low
license: DRL-1.1
related:
  - id: 538c5851-8c03-4724-8ec4-623bc7aadaea
    type: derived