HTML File Opened From Download Folder

Status: experimental
Severity: low
Log source: category process_creation, product windows
Author: Joseph Kamau
Source: github.com/SigmaHQ/sigma

Detects web browser process opening an HTML file from a user's Downloads folder. This behavior is could be associated with phishing attacks where threat actors send HTML attachments to users. When a user opens such an attachment, it can lead to the execution of malicious scripts or the download of malware. During investigation, analyze the HTML file for embedded scripts or links, check for any subsequent downloads or process executions, and investigate the source of the email or message containing the attachment.

Known false positives

Opening any HTML file located in users directories via a browser process will trigger this.

MITRE ATT&CK coverage

Tactic	Techniques
Reconnaissance	`T1598.002` Phishing for Information: Spearphishing Attachment
Initial Access	`T1566.001` Phishing: Spearphishing Attachment

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: HTML File Opened From Download Folder
id: 538c5851-8c03-4724-8ec4-623bc7aadaea
status: experimental
description: |
    Detects web browser process opening an HTML file from a user's Downloads folder.
    This behavior is could be associated with phishing attacks where threat actors send HTML attachments to users.
    When a user opens such an attachment, it can lead to the execution of malicious scripts or the download of malware.
    During investigation, analyze the HTML file for embedded scripts or links, check for any subsequent downloads or process executions, and investigate the source of the email or message containing the attachment.
references:
    - https://app.any.run/tasks/ae3c4ded-fd6a-43ed-8215-ba0ba574ad33
    - https://app.any.run/tasks/8901e2d5-0c5a-48ba-a8e9-10b5ed7e06f4
author: Joseph Kamau
date: 2025-12-05
tags:
    - attack.t1598.002
    - attack.t1566.001
    - attack.initial-access
    - attack.reconnaissance
    - detection.threat-hunting
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '\brave.exe'
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
            - '\opera.exe'
            - '\vivaldi.exe'
        CommandLine|contains|all:
            - ':\users\'
            - '\Downloads\'
            - '.htm'
    condition: selection
falsepositives:
    - Opening any HTML file located in users directories via a browser process will trigger this.
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|endswith:
        - '\brave.exe'
        - '\chrome.exe'
        - '\firefox.exe'
        - '\msedge.exe'
        - '\opera.exe'
        - '\vivaldi.exe'
    CommandLine|contains|all:
        - ':\users\'
        - '\Downloads\'
        - '.htm'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`.htm` `:\users\` corpus 6 (sigma 6) `\Downloads\` corpus 15 (sigma 14, elastic 1)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\brave.exe` corpus 11 (sigma 11) `\chrome.exe` corpus 13 (sigma 13) `\firefox.exe` corpus 6 (sigma 6) `\msedge.exe` corpus 14 (sigma 14) `\opera.exe` corpus 11 (sigma 11) `\vivaldi.exe` corpus 11 (sigma 11)	`field:"Image" kind:ends_with`