Download lineage is the provenance trail for a file: where it originated, how it moved through the system, and which processes handled it before it reached the endpoint. It can include the browser tab or process that initiated the download, helper processes that wrote the file, and any scripts, unpackers, or loaders that modified it along the way.
This matters because many attacks hide behind ordinary-looking web activity. A malicious file may appear harmless if defenders only check its final hash, but lineage can reveal that it came from a suspicious page, passed through unusual browser components, or was executed by a process that should not launch downloads. Security tools use lineage in EDR, browser telemetry, and sandboxing to reconstruct parent-child process chains, spot tampering, and separate legitimate downloads from staged malware delivery. In practice, strong download lineage helps defenders answer a key question: not just what file arrived, but how it got there.