AN0872
Analytic 0872
Windows
Detection of browser-based or email client-driven file creation (often from temp directories) following navigation to or execution of HTML files containing JavaScript Blob APIs or base64 Data URLs, with follow-on execution of the dropped payload. Leveraging Sysmon EventID 15 to inspect Zone.Identifier ADS for HostUrl/ReferrerUrl indicators (e.g., HostUrl=about:internet). Optional: absence of a large HTTP download record for the same URL/client in proxy logs (suggests local assembly)
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=1
EDR:detection
App reputation telemetry
WinEventLog:Sysmon
EventCode=15
Network Traffic
None
[TimeWindow]
Time range between HTML file open and file drop + execution (e.g., 1–10 minutes)
[DroppedFileExtensionWatchlist]
Tunable list of file extensions of interest (e.g., .js, .hta, .exe)
[ParentProcessName]
Expected processes that may drop files (e.g., browser, Outlook); tune for normal behavior
AN0873
Analytic 0873
Linux
Detection of browser-based downloads from HTML sources that trigger file creation in temp or user directories followed by execution of new files within short timeframes and suspicious parent-child lineage.
auditd:SYSCALL
execve
linux:osquery
file_events
[DownloadPathRegex]
Regular expressions for common download paths (e.g., /tmp/, ~/Downloads/)
[ExecutableTriggerWindow]
Tunable range for follow-up process execution from dropped file (e.g., 5–15 minutes)
AN0874
Analytic 0874
macOS
Detection of HTML-based downloads via Safari/Chrome that create obfuscated files (e.g., .zip, .app, .js) in user directories and are followed by suspicious executions from preview or launch services.
macos:unifiedlog
File Events
macos:osquery
process_events
gatekeeper/quarantine database
LaunchServices quarantine
[QuarantineFlagCheck]
Whether downloaded file has a quarantine flag and is bypassed via Gatekeeper
[BlobKeywordAlertList]
JavaScript strings that may indicate smuggling: msSaveBlob, download.href, createObjectURL