Windows PresentationHost.EXE downloading files via URL in command line

title: Windows PresentationHost.EXE downloading files via URL in command line
id: 40bc184c-e353-4aa8-aed0-92a124599503
status: test
description: This rule identifies process executions of PresentationHost.exe where the command line contains a URL scheme (http://, https://, or ftp://). PresentationHost can be used to run .xbap Browser Application content, which may facilitate arbitrary file downloads. The detection relies on Windows process creation telemetry, matching the process image (PresentationHost.exe) and the presence of URL strings in the command line.
references:
  - https://github.com/LOLBAS-Project/LOLBAS/pull/239/files
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_presentationhost_download.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-19
modified: 2023-11-09
tags:
  - attack.execution
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \presentationhost.exe
    - OriginalFileName: PresentationHost.exe
  selection_cli:
    CommandLine|contains:
      - http://
      - https://
      - ftp://
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: b124ddf4-778d-418e-907f-6dd3fc0d31cd
    type: derived