Sigma rule: HTML File Opened From Download Folder

Rule

Title

HTML File Opened From Download Folder

Status

experimental

Level

low

Author

Joseph Kamau

Date

2025-12-05

File

rules-threat-hunting/windows/process_creation/proc_creation_win_susp_open_html_file_from_download_folder.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects web browser process opening an HTML file from a user's Downloads folder.
This behavior is could be associated with phishing attacks where threat actors send HTML attachments to users.
When a user opens such an attachment, it can lead to the execution of malicious scripts or the download of malware.
During investigation, analyze the HTML file for embedded scripts or links, check for any subsequent downloads or process executions, and investigate the source of the email or message containing the attachment.

Log source

product

windows

category

process_creation

Detection

selection:
    Image|endswith:
        - '\brave.exe'
        - '\chrome.exe'
        - '\firefox.exe'
        - '\msedge.exe'
        - '\opera.exe'
        - '\vivaldi.exe'
    CommandLine|contains|all:
        - ':\users\'
        - '\Downloads\'
        - '.htm'
condition: selection

False positives (as the rule lists them)

• Opening any HTML file located in users directories via a browser process will trigger this.

Tags

• attack.t1598.002
• attack.t1566.001
• attack.initial-access
• attack.reconnaissance
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1566.001
• T1598.002

References

• https://app.any.run/tasks/ae3c4ded-fd6a-43ed-8215-ba0ba574ad33
• https://app.any.run/tasks/8901e2d5-0c5a-48ba-a8e9-10b5ed7e06f4

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_open_html_file_from_download_folder.yml