Browser writing executable content outside its download folder

Siemphony@siemphonymediumT1189unverified

Matches the unexpected file drop leg of MITRE's AN0498 — a browser process itself creating an executable, script or shortcut file somewhere other than the user's download directory and the browser's own program and profile directories. That framing is deliberate: a rule on the browser spawning a child process would be indistinguishable from the client-exploitation rule already authored for T1203, and a write into the download folder is the user-initiated download that belongs to T1204. What remains is content the page placed on disk without a save dialog. The analytic's other legs — the suspicious fetch, the correlation window, the entropy of the payload — are a multi-source join with numeric thresholds that Sigma has no construct for. Requires Sysmon file creation logging with a configuration that does not exclude these extensions or the browsers; the widely used community configs narrow EventID 11 sharply, and a narrowed config makes this rule silent rather than clean. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0176, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceFileEvents| where (((InitiatingProcessFolderPath endswith "\\chrome.exe" or InitiatingProcessFolderPath endswith "\\msedge.exe" or InitiatingProcessFolderPath endswith "\\firefox.exe" or InitiatingProcessFolderPath endswith "\\iexplore.exe" or InitiatingProcessFolderPath endswith "\\brave.exe" or InitiatingProcessFolderPath endswith "\\opera.exe") and (FolderPath endswith ".exe" or FolderPath endswith ".dll" or FolderPath endswith ".scr" or FolderPath endswith ".hta" or FolderPath endswith ".js" or FolderPath endswith ".jse" or FolderPath endswith ".vbs" or FolderPath endswith ".vbe" or FolderPath endswith ".wsf" or FolderPath endswith ".ps1" or FolderPath endswith ".lnk" or FolderPath endswith ".jar")) and not ((FolderPath contains "\\Downloads\\" or FolderPath contains "\\Google\\Chrome\\Application\\" or FolderPath contains "\\Google\\Chrome\\User Data\\" or FolderPath contains "\\Google\\Update\\" or FolderPath contains "\\Microsoft\\Edge\\Application\\" or FolderPath contains "\\Microsoft\\Edge\\User Data\\" or FolderPath contains "\\Microsoft\\EdgeUpdate\\" or FolderPath contains "\\Mozilla Firefox\\" or FolderPath contains "\\Mozilla\\Firefox\\Profiles\\")))

Splunk · SPL

Run this as a search.

index=* (((Image="*\\chrome.exe" OR Image="*\\msedge.exe" OR Image="*\\firefox.exe" OR Image="*\\iexplore.exe" OR Image="*\\brave.exe" OR Image="*\\opera.exe") AND (TargetFilename="*.exe" OR TargetFilename="*.dll" OR TargetFilename="*.scr" OR TargetFilename="*.hta" OR TargetFilename="*.js" OR TargetFilename="*.jse" OR TargetFilename="*.vbs" OR TargetFilename="*.vbe" OR TargetFilename="*.wsf" OR TargetFilename="*.ps1" OR TargetFilename="*.lnk" OR TargetFilename="*.jar")) AND NOT ((TargetFilename="*\\Downloads\\*" OR TargetFilename="*\\Google\\Chrome\\Application\\*" OR TargetFilename="*\\Google\\Chrome\\User Data\\*" OR TargetFilename="*\\Google\\Update\\*" OR TargetFilename="*\\Microsoft\\Edge\\Application\\*" OR TargetFilename="*\\Microsoft\\Edge\\User Data\\*" OR TargetFilename="*\\Microsoft\\EdgeUpdate\\*" OR TargetFilename="*\\Mozilla Firefox\\*" OR TargetFilename="*\\Mozilla\\Firefox\\Profiles\\*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.executable) LIKE "*\\\\chrome.exe" OR TO_LOWER(process.executable) LIKE "*\\\\msedge.exe" OR TO_LOWER(process.executable) LIKE "*\\\\firefox.exe" OR TO_LOWER(process.executable) LIKE "*\\\\iexplore.exe" OR TO_LOWER(process.executable) LIKE "*\\\\brave.exe" OR TO_LOWER(process.executable) LIKE "*\\\\opera.exe") AND (TO_LOWER(file.path) LIKE "*.exe" OR TO_LOWER(file.path) LIKE "*.dll" OR TO_LOWER(file.path) LIKE "*.scr" OR TO_LOWER(file.path) LIKE "*.hta" OR TO_LOWER(file.path) LIKE "*.js" OR TO_LOWER(file.path) LIKE "*.jse" OR TO_LOWER(file.path) LIKE "*.vbs" OR TO_LOWER(file.path) LIKE "*.vbe" OR TO_LOWER(file.path) LIKE "*.wsf" OR TO_LOWER(file.path) LIKE "*.ps1" OR TO_LOWER(file.path) LIKE "*.lnk" OR TO_LOWER(file.path) LIKE "*.jar")) AND NOT ((TO_LOWER(file.path) LIKE "*\\\\downloads\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\google\\\\chrome\\\\application\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\google\\\\chrome\\\\user data\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\google\\\\update\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\microsoft\\\\edge\\\\application\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\microsoft\\\\edge\\\\user data\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\microsoft\\\\edgeupdate\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\mozilla firefox\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\mozilla\\\\firefox\\\\profiles\\\\*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,file_event,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\chrome\.exe$|\\msedge\.exe$|\\firefox\.exe$|\\iexplore\.exe$|\\brave\.exe$|\\opera\.exe$)</field>    <field name="TargetFilename" type="pcre2">(?i)(\.exe$|\.dll$|\.scr$|\.hta$|\.js$|\.jse$|\.vbs$|\.vbe$|\.wsf$|\.ps1$|\.lnk$|\.jar$)</field>    <field name="TargetFilename" negate="yes" type="pcre2">(?i)(\\Downloads\\|\\Google\\Chrome\\Application\\|\\Google\\Chrome\\User Data\\|\\Google\\Update\\|\\Microsoft\\Edge\\Application\\|\\Microsoft\\Edge\\User Data\\|\\Microsoft\\EdgeUpdate\\|\\Mozilla Firefox\\|\\Mozilla\\Firefox\\Profiles\\)</field>    <description>Browser writing executable content outside its download folder</description>    <mitre>      <id>T1189</id>    </mitre>  </rule></group>

At a glance

Logsource: file_event / windows
Level: medium
Category: exploitation_initial_access
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 8d7edd5f-1ba4-45c8-ba4f-da2dc08de910

ATT&CKT1189

T1189Drive-by Compromise

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonexploitation initial access

exploitation initial accessAI draft — unreviewed

01 · What this rule detects

A browser process writing an executable, script or shortcut file to disk somewhere other than the download folder and the browser's own directories. MITRE's AN0498 describes the whole chain: a fetch to a suspicious domain, then an odd child process, then memory modification, then an unexpected file drop — across four log sources, joined by a time window and an entropy threshold. Sigma expresses none of that. So the author picked one link and stated why: a child-process rule would duplicate the T1203 rule already in this corpus, and a write into Downloads is a user-initiated download belonging to T1204. What is left is the drop the page performed without a save dialog. Choosing one link deliberately is good practice. What follows is what happens when the pieces of that one link do not line up.

02 · Telemetry you need

Sysmon EventID 11 (FileCreate) on Windows, carrying Image and TargetFilename. The description already warns you that the widely-used community Sysmon configs narrow EID 11 to a short path allowlist — under one of those, this rule is silent rather than clean.
A second mechanic goes unstated: Chrome and Edge write downloads as *.crdownload, Firefox as *.part, renaming to the final name on completion. EID 11 fires on the .crdownload create, whose TargetFilename matches none of the twelve extensions, and Sysmon has no rename event that re-fires FileCreate with the final name. Some browser-written executables therefore never present a matching filename at all.
sentinel_kql is refused here — no Sentinel table is modelled for file_event/windows, so that KQL would be hand-written.

03 · How the logic works

Three blocks: selection_browser and selection_payload and not filter_expected_paths.

Read the browser list against the filter list, side by side. Six browsers are admitted; the filter covers three of them. There is no \BraveSoftware\Brave-Browser\Application\ and no \Programs\Opera\. Both browsers self-update by writing a complete versioned Application directory of .exe and .dll files, performed by the running browser process, several times a month. On any host with Brave or Opera this rule produces a burst of dozens of alerts on every update cycle — not a possibility, a certainty from the rule's own logic. This is the shape error to learn. A negative filter must cover everything the positive selection admits. Extend a selection without extending the filter and you do not get broader coverage — you get a guaranteed weekly false positive that gets the rule muted. Whenever you add a selection term, walk every filter block and ask what that term now lets through. The rule's third false positive is worse than absent: it calls this "portable browser installs and per-user or non-standard install paths". For Brave and Opera the unfiltered path is the standard one. A false positive described as an edge case, when it is the default case, sends a tuner to the wrong place. Two more. filter_expected_paths uses contains on '\Downloads\', matching that segment anywhere — C:\ProgramData\Downloads\ suppresses the alert, and the drop directory is attacker-chosen. And excluding the whole Downloads tree costs more than the description admits: HTML smuggling, the dominant drive-by delivery mechanism, writes to the default Downloads folder with no dialog, because "ask where to save" is off by default.

04 · Common false positives

Brave and Opera self-updates — the top talker, and unacknowledged.
Chrome and Edge writing .lnk files to the Desktop and Start Menu on install,
Any user whose downloads go to the Desktop or a synced folder.
Save-as and drag-out of a webmail attachment.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0176 and never executed against a single log line.
tier_2: begins by running it for one Brave or Opera update cycle and counting.
tier_3: needs the correlation the analytic actually describes — fetch, drop and execution inside MITRE's TimeWindow knob — which lives outside Sigma entirely.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Complete the filter list per browser in your estate, or remove the browsers you have not filtered. Anchor Downloads to the user profile — contains|all: ['\Users\', '\Downloads\']. Consider letting .hta, .jse, .vbe, .wsf and .scr through the Downloads exclusion; nobody downloads those on purpose. MITRE's ExtensionInstallPolicy knob belongs to AN0500, the macOS analytic — know whose analytic you are quoting before it reaches a tuning ticket.

Declared by the author

A user whose download directory is not the default one. Redirecting downloads to the desktop, to Documents or to a synced folder puts every ordinary download outside the filter and makes this rule fire on normal browsing. This is the first thing to check when tuning, and the filter path list is where the estate's real download locations belong.
Save-as and drag-out. Choosing a location in the save dialog, or dragging an attachment out of a webmail page, writes the file wherever the user pointed and is recorded against the browser process exactly as a silent drop would be.
Portable browser installs and per-user or non-standard install paths, which place the browser's own executables and libraries outside the program directories listed in the filter, so self-update rewrites them into an unfiltered path.
Extension and plugin installation, which writes script files into profile subdirectories that vary by browser build and may not be covered by the profile paths filtered here. MITRE's ExtensionInstallPolicy knob for the macOS analytic is the same idea — a strict install policy is what makes these predictable enough to exclude.

Noise check0 of 3 fired

Fires on none of the 3 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 3 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1189, evaluated against their file_event events.

Share this rule

/u/siemphony/8d7edd5f-1ba4-45c8-ba4f-da2dc08de910

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Browser writing executable content outside its download folder

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it