Sunturai
Back to results
MediumSigmaHQJoseph Kamau

Potential Suspicious Browser Launch From Document Reader Process

Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc. And connects to a web application over http(s), this could indicate a…

Description

Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc. And connects to a web application over http(s), this could indicate a possible phishing attempt.

Detection logic

Detection requirements

Platform
LinuxmacOSWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source product
windows
Log source category
process_creation

Known benign triggers

  • Unlikely in most cases, further investigation should be done in the commandline of the browser process to determine the context of the URL accessed.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice