Adobe reader spawns a browser

BIOC Informational

Adobe reader spawns a browser

If a user clicks a URL link contained in a PDF document, it will cause the Adobe Reader process to spawn a browser process. It has legitimate uses, but check for possible phishing attempts.

Module:: Platform Analytics
Agent event type:: Process execution
Category:: Dropper
Status:: Enabled

ATT&CK tactics: Initial Access (TA0001)

ATT&CK techniques: Phishing: Spearphishing Attachment (T1566.001)

Indicator:

Process action type = execution AND target process name = iexplore.exe , chrome.exe , firefox.exe , opera.exe , microsoftedge.exe , microsoftedgecp.exe , safari.exe Process initiated by = acrord32.exe , cgo name = acrord32.exe AND initiator signer = *adobe systems* , cgo signer = *adobe systems* AND initiator signature = Signed , cgo signature = Signed Host host os = windows

Preventable: yes