Silent EXE Download via Hidden No-Referrer Anchor (SilverFox)
Detects executable file downloads initiated by common web browsers where the associated Zone.Identifier (Mark-of-the-Web) file lacks a ReferrerUrl. This pattern is often used by malware to conceal the source of a payload, potentially indicating a direct download or a hidden link redirection that bypassed standard referral tracking.
Sigma
