Potential Suspicious Browser Launch From Document Reader Process

 1title: Potential Suspicious Browser Launch From Document Reader Process
 2id: 1193d960-2369-499f-a158-7b50a31df682
 3status: test
 4description: |
 5        Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc. And connects to a web application over http(s), this could indicate a possible phishing attempt.
 6references:
 7    - https://app.any.run/tasks/69c5abaa-92ad-45ba-8c53-c11e23e05d04/ # PDF Document
 8    - https://app.any.run/tasks/64043a79-165f-4052-bcba-e6e49f847ec1/ # Office Document
 9author: Joseph Kamau
10date: 2024-05-27
11modified: 2025-10-07
12tags:
13    - attack.execution
14    - attack.t1204.002
15logsource:
16    product: windows
17    category: process_creation
18detection:
19    selection:
20        ParentImage|contains:
21            - 'Acrobat Reader'
22            - 'Microsoft Office'
23            - 'PDF Reader'
24        Image|endswith:
25            - '\brave.exe'
26            - '\chrome.exe'
27            - '\firefox.exe'
28            - '\msedge.exe'
29            - '\opera.exe'
30            - '\maxthon.exe'
31            - '\seamonkey.exe'
32            - '\vivaldi.exe'
33        CommandLine|contains: 'http'
34    filter_main_microsoft_help:
35        CommandLine|contains: 'https://go.microsoft.com/fwlink/'
36    filter_optional_foxit:
37        CommandLine|contains:
38            - 'http://ad.foxitsoftware.com/adlog.php?'
39            - 'https://globe-map.foxitservice.com/go.php?do=redirect'
40    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
41falsepositives:
42    - Unlikely in most cases, further investigation should be done in the commandline of the browser process to determine the context of the URL accessed.
43level: medium