Title:
Potential Suspicious Browser Launch From Document Reader Process
Status:
test
Description:Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc. And connects to a web application over http(s), this could indicate a possible phishing attempt.
References:
-https://app.any.run/tasks/69c5abaa-92ad-45ba-8c53-c11e23e05d04/
-https://app.any.run/tasks/64043a79-165f-4052-bcba-e6e49f847ec1/
Author: Joseph Kamau
Date: 2024-05-27
modified:2025-10-07
Tags:
- -'attack.execution'
- -'attack.t1204.002'
Logsource:
- product: windows
- category: process_creation
Detection:
selection:
ParentImage|contains:
-'Acrobat Reader'
-'Microsoft Office'
-'PDF Reader'
Image|endswith:
-'\brave.exe'
-'\chrome.exe'
-'\firefox.exe'
-'\msedge.exe'
-'\opera.exe'
-'\maxthon.exe'
-'\seamonkey.exe'
-'\vivaldi.exe'
CommandLine|contains:
'http'
filter_main_microsoft_help:
CommandLine|contains:
'https://go.microsoft.com/fwlink/'
filter_optional_foxit:
CommandLine|contains:
-'http://ad.foxitsoftware.com/adlog.php?'
-'https://globe-map.foxitservice.com/go.php?do=redirect'
condition:
selection and not 1 of filter_main_* and not 1 of filter_optional_*
Falsepositives:
-Unlikely in most cases, further investigation should be done in the commandline of the browser process to determine the context of the URL accessed.
Level:
medium
