Web Browser Opens .HTM/.HTML from Downloads Folder on Windows
Flags browser processes opening .htm files from a user’s Downloads folder on Windows, a pattern consistent with HTML attachment activity.
- Product
- windows
- Category
- process_creation
- Author
- Joseph Kamau (SigmaHQ), DRL 1.1
- Published
- 2025-12-05
- Updated
- 2026-07-31
ATT&CK techniques
Recon → Initial AccessResource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags when common web browsers (Chrome, Firefox, Edge, Opera, Brave, Vivaldi) launch with command-line parameters indicating an HTML file (containing .htm) located under the user Downloads directory. Attackers may use HTML attachments or links to deliver malicious content and drive follow-on actions once opened by the browser. It relies on Windows process creation telemetry capturing the browser executable and its command line, including the Downloads path and file extension.
Reporting behind it
- app.any.runhttps://app.any.run/tasks/ae3c4ded-fd6a-43ed-8215-ba0ba574ad33
- app.any.runhttps://app.any.run/tasks/8901e2d5-0c5a-48ba-a8e9-10b5ed7e06f4
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_open_html_file_from_download_folder.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Web Browser Opens .HTM/.HTML from Downloads Folder on Windows
id: fbeb2755-30b9-4d67-a4b1-ac86e24de2e4
status: experimental
description: This rule flags when common web browsers (Chrome, Firefox, Edge, Opera, Brave, Vivaldi) launch with command-line parameters indicating an HTML file (containing .htm) located under the user Downloads directory. Attackers may use HTML attachments or links to deliver malicious content and drive follow-on actions once opened by the browser. It relies on Windows process creation telemetry capturing the browser executable and its command line, including the Downloads path and file extension.
references:
- https://app.any.run/tasks/ae3c4ded-fd6a-43ed-8215-ba0ba574ad33
- https://app.any.run/tasks/8901e2d5-0c5a-48ba-a8e9-10b5ed7e06f4
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_open_html_file_from_download_folder.yml
author: Joseph Kamau, Huntrule Team
date: 2025-12-05
tags:
- attack.t1598.002
- attack.t1566.001
- attack.initial-access
- attack.reconnaissance
- detection.threat-hunting
logsource:
product: windows
category: process_creation
detection:
selection:
Image|endswith:
- \brave.exe
- \chrome.exe
- \firefox.exe
- \msedge.exe
- \opera.exe
- \vivaldi.exe
CommandLine|contains|all:
- :\users\
- \Downloads\
- .htm
condition: selection
falsepositives:
- Opening any HTML file located in users directories via a browser process will trigger this.
level: low
license: DRL-1.1
related:
- id: 538c5851-8c03-4724-8ec4-623bc7aadaea
type: derived