Windows: File Download via msedge_proxy.exe Using HTTP/HTTPS URLs

title: "Windows: File Download via msedge_proxy.exe Using HTTP/HTTPS URLs"
id: a2052634-18f1-4bf5-a550-364f232424b9
status: test
description: This rule identifies Windows process executions of msedge_proxy.exe where the command line includes http:// and https://, indicating an attempt to download an arbitrary file. Downloading via a trusted proxy binary can help attackers blend in with normal browser-adjacent activity and reduce suspicion. The detection relies on process creation telemetry, matching the executable name/path and the presence of HTTP/HTTPS in the command line.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/msedge_proxy/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msedge_proxy_download.yml
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2023-11-09
tags:
  - attack.execution
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \msedge_proxy.exe
    - OriginalFileName: msedge_proxy.exe
  selection_cli:
    CommandLine|contains:
      - http://
      - https://
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: e84d89c4-f544-41ca-a6af-4b92fd38b023
    type: derived