---
{
  "title": "Drive-by downloads",
  "summary": "Visiting or interacting with content can initiate unwanted download or execution paths.",
  "topic": "foundations",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "units": [
    3
  ],
  "aliases": [],
  "sources": [
    {
      "title": "NIST: An Introduction to Information Security",
      "url": "https://csrc.nist.gov/pubs/sp/800/12/r1/final"
    },
    {
      "title": "MITRE ATT&CK: Drive-by Compromise",
      "url": "https://attack.mitre.org/techniques/T1189/"
    }
  ],
  "published": "2026-10-02",
  "editorialVersion": 2
}
---

## The idea

Drive-by download describes malicious download activity associated with visiting or interacting with compromised or deceptive web content. Some paths exploit software weaknesses; others rely on misleading prompts or social engineering. The actual sequence matters. Browser updates, safe rendering, restricted privileges, filtering, and endpoint monitoring contribute to protection. Investigators should distinguish a downloaded file from successful execution and subsequent compromise.

## In practice

A browser visit is followed by a download and an unexpected child process. Those observations are correlated with source content and endpoint records.

## A common misunderstanding

A downloaded file is not automatically evidence that it executed, and every deceptive download is not an exploit of the browser.

## Check your understanding

What evidence helps establish execution?

**Think it through:** Process creation, command-line context, file relationships, and related system activity.


## Visiting, downloading, and executing are distinct stages

Web content can lead to an unwanted file or execution path through a compromised page, advertisement, redirect, or deceptive prompt. Some cases exploit a software weakness; others persuade a person to install or open material. The term is used broadly, so describe the actual sequence instead of assuming every download occurred without interaction.

Browser isolation, updates, application controls, and restricted privileges reduce different parts of the path. None makes every visited site trustworthy. A download can remain inert, while exploitation or later user activation can produce execution. Investigators need evidence for each transition when determining impact.

## A fictional redirected course search

An academy employee follows a search result for a course resource and reaches a page requesting an unexpected update. Endpoint records show a file download and a later process launch. Analysts preserve browser context, redirect information where available, file identity, and execution events. They avoid claiming that the original search result alone caused every later action.

Do not revisit a suspicious page from an ordinary workstation to reproduce the behavior. Dynamic content can change and may expose the investigator to unwanted activity. Use the organization's approved analysis process and preserve the original observations. A current clean page does not disprove earlier compromise or selective delivery.

## Trace a prepared web journey

Create fictional events for navigation, redirect, file creation, and process execution. Identify the point where the evidence supports unwanted download and the point where it supports activation. Add a case in which the download was blocked and explain the different impact conclusion.

Response should assess the device and access involved, not merely delete the visible file. Review whether additional components arrived or accounts were affected. Clear reporting and safe browsing workflows complement technical controls by helping staff pause and report unexpected installation prompts without being blamed for uncertainty.

## Keep exploring

- [[browser-artifacts]]
- [[malware]]
- [[endpoint-detection-response]]