Abstract: The present embodiments relate to detecting malware in a document management system (DMS). File stubs representing files remotely stored in a DMS can be presented in file managers at local computing devices for review/interaction on the local computing devices. A file stub for a specific file can be selected in the file manager, and a request to download the file can be provided to the DMS. The process in requesting the download of the file can be processed to determine whether the process is user-initiated or programmatic-initiated. If the process is user-initiated (e.g., initiated by a user on the local computing device), the file can be provided to the local computing device. Programmatic-initiated processes can be a result of software or malware, and mitigating actions can be taken if the request to download the file is a programmatic-initiated process.