Coverage › CVE-2015-5119

CVE-2015-5119 Mapped Sigma

Adobe Flash Player Use-After-Free Vulnerability

Vendor / product: Adobe — Flash Player
Description (CISA): A use-after-free vulnerability exists within the ActionScript 3 ByteArray class in Adobe Flash Player that allows an attacker to perform remote code execution.
Added to KEV: 2022-03-03
Due date: 2022-03-24
Required action: The impacted product is end-of-life and should be disconnected if still in use.
Known ransomware use: Unknown
CWE: CWE-119
CISA notes: https://nvd.nist.gov/vuln/detail/CVE-2015-5119
Elsewhere: cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

7 mapping objects across 7 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Technique	Mapping type	CTID comment	Status in v19.2
T1059.007 JavaScript	exploitation technique	To exploit this vulnerability, adversaries sent spearphishing emails with URLs to webpages with maliciously crafted javascript. The adversaries then download a payload. ref 1	live
T1203 Exploitation for Client Execution	exploitation technique	This vulnerability has been exploited in the wild by multiple different threat actors. Threat groups send phishing emails with URLs where maliciously-crafted javascript is hosted. This CVE has many mappable exploitation techniques and impacts. These adversaries using this exploit to deliver malicious payloads to the target machines establish DLL backdoors. ref 1	live
T1204.001 Malicious Link	exploitation technique	To exploit this vulnerability, adversaries sent spearphishing emails with URLs to webpages with maliciously crafted javascript. The adversaries then download a payload. ref 1	live
T1566.002 Spearphishing Link	exploitation technique	To exploit this vulnerability, adversaries sent spearphishing emails with URLs to webpages with maliciously crafted javascript. The adversaries then download a payload. ref 1	live
T1055.001 Dynamic-link Library Injection	secondary impact	This vulnerability has been exploited in the wild by multiple different threat actors. Threat groups send phishing emails with URLs where maliciously-crafted javascript is hosted. This CVE has many mappable exploitation techniques and impacts. These adversaries using this exploit to deliver malicious payloads to the target machines establish DLL backdoors. ref 1	live
T1071.001 Web Protocols	secondary impact	To exploit this vulnerability, adversaries sent spearphishing emails with URLs to webpages with maliciously crafted javascript. The adversaries then download a payload. ref 1	live
T1105 Ingress Tool Transfer	primary impact	To exploit this vulnerability, adversaries sent spearphishing emails with URLs to webpages with maliciously crafted javascript. The adversaries then download a payload. ref 1	live

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1055.001 Dynamic-link Library Injection secondary impact

DET0389 Behavioral Detection of DLL Injection via Windows API
AN1095 Windows
Detects DLL injection through correlation of memory allocation and writing to remote process memory (e.g., VirtualAllocEx, WriteProcessMemory), followed by remote thread creation (e.g., CreateRemoteThread) that loads a suspicious or unsigned DLL using LoadLibrary or reflective loading.

WinEventLog:Sysmon EventCode=10 → DC0035 Process Access
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=7 → DC0016 Module Load
WinEventLog:Sysmon EventCode=17 → DC0048 Named Pipe Metadata

Tunable: InjectedDLLSignatureStatus TimeWindow TargetProcessList ParentProcessAnomalyThreshold

Sigma rules tagged `attack.t1055.001` (8)

CreateRemoteThread API and LoadLibrary mediumtest

Author: Roberto Rodriguez @Cyb3rWard0g · 2019-08-11 (modified 2024-01-22) · logsource: product=windows category=create_remote_thread · 052ec6f6-1adc-41e6-907a-f1c813478bee

Detects potential use of CreateRemoteThread api and LoadLibrary function to inject DLL into a process

Techniques: T1055.001

Potential DLL Injection Or Execution Using Tracker.exe mediumtest

Author: Avneet Singh @v3t0_, oscd.community · 2020-10-18 (modified 2023-01-09) · logsource: product=windows category=process_creation · 148431ce-4b70-403d-8525-fcc2993f29ea

Detects potential DLL injection and execution using "Tracker.exe"

Techniques: T1055.001

Renamed ZOHO Dctask64 Execution hightest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2020-01-28 (modified 2025-01-22) · logsource: product=windows category=process_creation · 340a090b-c4e9-412e-bb36-b4b16fe96f9b

Detects a renamed "dctask64.exe" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.

Techniques: T1036 T1055.001 T1202 T1218

Mavinject Inject DLL Into Running Process hightest

Author: frack113, Florian Roth · 2021-07-12 (modified 2022-12-05) · logsource: product=windows category=process_creation · 4f73421b-5a0b-4bbf-a892-5a7fb99bea66

Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag

Techniques: T1055.001 T1218.013

HackTool - Potential CobaltStrike Process Injection hightest

Author: Olaf Hartong, Florian Roth (Nextron Systems), Aleksey Potapov, oscd.community · 2018-11-30 (modified 2023-05-05) · logsource: product=windows category=create_remote_thread · 6309645e-122d-4c5b-bb2b-22e4f9c2fa42

Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons

Techniques: T1055.001

ManageEngine Endpoint Central Dctask64.EXE Potential Abuse hightest

Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.

Techniques: T1055.001

TAIDOOR RAT DLL Load hightest

Author: Florian Roth (Nextron Systems) · 2020-07-30 (modified 2021-11-27) · logsource: product=windows category=process_creation · d1aa3382-abab-446f-96ea-4de52908210b

Detects specific process characteristics of Chinese TAIDOOR RAT malware load

Techniques: T1055.001

Renamed Mavinject.EXE Execution hightest

Author: frack113, Florian Roth · 2022-12-05 (modified 2023-02-03) · logsource: product=windows category=process_creation · e6474a1b-5390-49cd-ab41-8d88655f7394

Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection using the "/INJECTRUNNING" flag

Techniques: T1055.001 T1218.013

T1059.007 JavaScript exploitation technique

DET0264 Cross-Platform Detection of JavaScript Execution Abuse
AN0733 Windows
Detects JavaScript execution through WSH (wscript.exe, cscript.exe) or HTA (mshta.exe), particularly when spawned from Office macros, web browsers, or abnormal user paths. Correlates script execution with outbound network activity or system modification.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
m365:defender ScriptBlockLogging + AMSI → DC0029 Script Execution
WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

Tunable: ParentProcess ScriptPath TimeWindow UserContext EntropyScore

AN0734 macOS
Detects JavaScript for Automation (JXA) via osascript or compiled scripts using OSAKit APIs. Flags execution involving system modification, inter-process scripting, or browser abuse.

macos:unifiedlog log stream with predicate 'eventMessage CONTAINS "osascript"' → DC0029 Script Execution
macos:osquery process_events → DC0032 Process Creation
macos:syslog /var/log/system.log → DC0064 Command Execution

Tunable: ScriptLocation ParentProcess APIInvocation

AN0735 Linux
Detects Node.js or JavaScript interpreter execution from web shells, cron jobs, or local users. Correlates execution with reverse shell behavior, file modifications, or abnormal outbound connections.

auditd:SYSCALL execve → DC0032 Process Creation
linux:syslog /var/log/syslog → DC0029 Script Execution

Tunable: ScriptPath BinaryName UserExecutionContext NetworkFollowUp

Sigma rules tagged `attack.t1059.007` (29)

WScript or CScript Dropper - File hightest

Author: Tim Shelton · 2022-01-10 (modified 2026-02-17) · logsource: product=windows category=file_event · 002bdb95-0cf1-46a6-9e08-d38c128a6127

Detects a file ending in jse, vbe, js, vba, vbs, wsf, wsh written by cscript.exe or wscript.exe

Techniques: T1059.005 T1059.007

XSL Script Execution Via WMIC.EXE mediumtest

Author: Timur Zinniatullin, oscd.community, Swachchhanda Shrawan Poudel · 2019-10-21 (modified 2026-01-24) · logsource: product=windows category=process_creation · 05c36dd6-79d6-4a9a-97da-3db20298ab2d

Detects the execution of WMIC with the "format" flag to potentially load local XSL files. Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.

Techniques: T1047 T1220 T1059.005 T1059.007

Adwind RAT / JRAT File Artifact hightest

Author: Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community · 2017-11-10 (modified 2022-12-02) · logsource: product=windows category=file_event · 0bcfabcb-7929-47f4-93d6-b33fb67d34d1

Detects javaw.exe in AppData folder as used by Adwind / JRAT

Techniques: T1059.005 T1059.007

Script Interpreter Spawning Credential Scanner - Windows highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-25 · logsource: product=windows category=process_creation · 0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6

Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks). This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.

Techniques: T1552 T1005 T1059.007

Potential In-Memory Download And Compile Of Payloads mediumtest

Author: Sohan G (D4rkCiph3r), Red Canary (idea) · 2023-08-22 · logsource: product=macos category=process_creation · 13db8d2e-7723-4c2c-93c1-a4d36994f7ef

Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware

Techniques: T1059.007 T1105

WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript mediumtest

Author: Michael Haag · 2019-01-16 (modified 2026-02-17) · logsource: product=windows category=process_creation · 1e33157c-53b1-41ad-bbcc-780b80b58288

Detects script file execution (.js, .jse, .vba, .vbe, .vbs, .wsf, .wsh) by Wscript/Cscript.

Techniques: T1059.005 T1059.007

Adwind RAT / JRAT hightest

Author: Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community · 2017-11-10 (modified 2022-10-09) · logsource: product=windows category=process_creation · 1fac1481-2dbc-48b2-9096-753c49b4ec71

Detects javaw.exe in AppData folder as used by Adwind / JRAT

Techniques: T1059.005 T1059.007

TanStack Supply-Chain Attack File Creation Indicators - Linux mediumexperimental

Author: Leonardo Gasparini · 2026-05-12 · logsource: product=linux category=file_event · 2b5e4d3f-7c9a-4fab-a8d1-3e6f5a7b8c9d

Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026.

Techniques: T1195.002 T1059.007 T1547.004

HackTool - CACTUSTORCH Remote Thread Creation hightest

Author: @SBousseaden (detection), Thomas Patzke (rule) · 2019-02-01 (modified 2023-05-05) · logsource: product=windows category=create_remote_thread · 2e4e488a-6164-4811-9ea1-f960c7359c40

Detects remote thread creation from CACTUSTORCH as described in references.

Techniques: T1055.012 T1059.005 T1059.007 T1218.005

TanStack Supply-Chain Attack Execution Indicators - Linux highexperimental

Author: Leonardo Gasparini · 2026-05-12 · logsource: product=linux category=process_creation · 3c6f5e4a-8d0b-6abc-d9e2-4f7a6b8c9d0e

Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026. The preinstall hook runs setup.mjs, which downloads a platform-specific Bun runtime.

Techniques: T1059.007 T1059.006 T1204.002

AppLocker Prevented Application or Script from Running mediumtest

Author: Pushkarev Dmitry · 2020-06-28 (modified 2025-12-03) · logsource: product=windows service=applocker · 401e5d00-b944-11ea-8f9a-00163ecd60ae

Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.

Techniques: T1204.002 T1059.001 T1059.003 T1059.005 T1059.006 T1059.007

HTML Help HH.EXE Suspicious Child Process hightest

Author: Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems) · 2020-04-01 (modified 2023-04-12) · logsource: product=windows category=process_creation · 52cad028-0ff0-4854-8f67-d25dfcbc78b4

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

Techniques: T1047 T1059.001 T1059.003 T1059.005 T1059.007 T1218 T1218.001 T1218.010 T1218.011 T1566 T1566.001

AppLocker Application Would Have Been Blocked mediumexperimental

Author: heyyanu · 2026-03-26 · logsource: product=windows service=applocker · 557e3bd3-7f21-495d-8d50-7c8bdfb8041c

Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.

Techniques: T1204.002 T1059.001 T1059.003 T1059.005 T1059.006 T1059.007

HackTool - Koadic Execution hightest

Author: wagga, Jonhnathan Ribeiro, oscd.community · 2020-01-12 (modified 2023-02-11) · logsource: product=windows category=process_creation · 5cddf373-ef00-4112-ad72-960ac29bac34

Detects command line parameters used by Koadic hack tool

Techniques: T1059.003 T1059.005 T1059.007

Suspicious Deno File Written from Remote Source lowexperimental

Author: Josh Nickels, Michael Taggart · 2025-05-22 · logsource: product=windows category=file_event · 6c0ce3b6-85e2-49d4-9c3f-6e008ce9796e

Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL. This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.

Techniques: T1204 T1059.007 T1105

All 29 rules on the technique page →

T1071.001 Web Protocols secondary impact

DET0027 Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets
AN0075 Windows
Detects unexpected or high-volume HTTP/S/WebSocket communication from suspicious processes (e.g., PowerShell, rundll32) using uncommon user agents or mimicking browser traffic to unusual domains or IPs.

NSM:Flow http.log, ssl.log → DC0085 Network Traffic Content
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: ProcessNameExclusions UserAgentAnomalies OutboundByteRatioThreshold

AN0076 Linux
Detects curl, wget, Python requests, or custom HTTP clients communicating over non-standard ports, with repetitive or beacon-like patterns or POST-heavy behavior to rare domains.

NSM:Flow http.log, conn.log → DC0085 Network Traffic Content
auditd:SYSCALL execve → DC0032 Process Creation

Tunable: CommandLinePatternMatch BeaconIntervalWindow

AN0077 macOS
Detects applications such as Automator, AppleScript, or LaunchDaemons invoking HTTP/S traffic to non-standard domains or using suspicious headers (e.g., Base64 in URIs or cookie fields).

macos:osquery socket_events → DC0078 Network Traffic Flow
macos:unifiedlog log stream --predicate → DC0064 Command Execution

Tunable: SuspiciousParentProcess URIEntropyThreshold

AN0078 ESXi
Detects HTTP or HTTPS communication initiated by shell-based scripts or management daemons, especially those reaching public IPs over ports 80/443 using embedded curl or wget.

NSM:Flow SPAN or port-mirrored HTTP/S → DC0085 Network Traffic Content
esxi:shell /root/.ash_history or /etc/init.d/* → DC0032 Process Creation

Tunable: ShellScriptMatch ExternalConnectionFilter

AN0079 Network Devices
Detects Web protocol misuse such as encoded HTTP headers, WebSocket upgrade requests with abnormal payloads, or TLS handshake anomalies suggesting embedded C2 channels.

NSM:Flow http.log, ssl.log, websocket.log → DC0085 Network Traffic Content

Tunable: HeaderEncodingPattern TLSFingerprintMismatch

Sigma rules tagged `attack.t1071.001` (42)

DNS Query To Devtunnels Domain mediumtest

Author: citron_ninja · 2023-10-25 (modified 2023-11-20) · logsource: product=windows category=dns_query · 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b

Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Techniques: T1071.001 T1572

HTTP Request With Empty User Agent mediumtest

Author: Florian Roth (Nextron Systems) · 2017-07-08 (modified 2021-11-27) · logsource: category=proxy · 21e44d78-95e7-421b-a464-ffd8395659c4

Detects a potentially suspicious empty user agent strings in proxy log. Could potentially indicate an uncommon request method.

Techniques: T1071.001

PwnDrp Access criticaltest

Author: Florian Roth (Nextron Systems) · 2020-04-15 (modified 2021-11-27) · logsource: category=proxy · 2b1ee7e4-89b6-4739-b7bb-b811b6607e5e

Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity

Techniques: T1071.001 T1102.001 T1102.003

Renamed Visual Studio Code Tunnel Execution hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-09-28 (modified 2025-10-29) · logsource: product=windows category=process_creation · 2cf29f11-e356-4f61-98c0-1bdb9393d6da

Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

Techniques: T1071.001 T1219

HackTool - BabyShark Agent Default URL Pattern criticaltest

Author: Florian Roth (Nextron Systems) · 2021-06-09 (modified 2024-02-15) · logsource: category=proxy · 304810ed-8853-437f-9e36-c4975c3dfd7e

Detects Baby Shark C2 Framework default communication patterns

Techniques: T1071.001

Visual Studio Code Tunnel Service Installation mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-10-25 · logsource: product=windows category=process_creation · 30bf1789-379d-4fdc-900f-55cd0a90a801

Detects the installation of VsCode tunnel (code-tunnel) as a service.

Techniques: T1071.001

Curl.EXE Execution With Custom UserAgent mediumtest

Author: frack113 · 2022-01-23 (modified 2023-02-21) · logsource: product=windows category=process_creation · 3286d37a-00fd-41c2-a624-a672dcd34e60

Detects execution of curl.exe with custom useragent options

Techniques: T1071.001

Outbound Network Connection Initiated By Microsoft Dialer hightest

Author: CertainlyP · 2024-04-26 · logsource: product=windows category=network_connection · 37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1

Detects outbound network connection initiated by Microsoft Dialer. The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer. This is an outdated process in the current conext of it's usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys"

Techniques: T1071.001

Wannacry Killswitch Domain hightest

Author: Mike Wade · 2020-09-16 (modified 2022-03-24) · logsource: category=dns · 3eaf6218-3bed-4d8a-8707-274096f12a18

Detects wannacry killswitch domain dns queries

Techniques: T1071.001

Raw Paste Service Access hightest

Author: Florian Roth (Nextron Systems) · 2019-12-05 (modified 2023-01-19) · logsource: category=proxy · 5468045b-4fcc-4d1a-973c-c9c9578edacb

Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form

Techniques: T1071.001 T1102.001 T1102.003

APT40 Dropbox Tool User Agent hightest

Author: Thomas Patzke · 2019-11-12 (modified 2023-05-18) · logsource: category=proxy · 5ba715b6-71b7-44fd-8245-f66893e81b3d

Detects suspicious user agent string of APT40 Dropbox tool

Techniques: T1071.001 T1567.002

Malware User Agent hightest

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2017-07-08 (modified 2024-04-14) · logsource: category=proxy · 5c84856b-55a5-45f1-826f-13f37250cf4e

Detects suspicious user agent strings used by malware in proxy logs

Techniques: T1071.001

APT User Agent hightest

Author: Florian Roth (Nextron Systems), Markus Neis · 2019-11-12 (modified 2024-02-15) · logsource: category=proxy · 6ec820f2-e963-4801-9127-d8b2dce4d31b

Detects suspicious user agent strings used in APT malware in proxy logs

Techniques: T1071.001

Suspicious User Agent hightest

Author: Florian Roth (Nextron Systems) · 2017-07-08 (modified 2022-10-31) · logsource: category=proxy · 7195a772-4b3f-43a4-a210-6a003d65caa1

Detects suspicious malformed user agent strings in proxy logs

Techniques: T1071.001

Axios NPM Compromise Malicious C2 Domain DNS Query highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-04-01 · logsource: category=dns · 73e5d24f-493f-4092-bd2f-c72cabda40ee

Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. This detection detects endpoints attempting to resolve the attacker's C2 domain (sfrclak.com) used for command and control communication.

Techniques: T1071.001 T1568

All 42 rules on the technique page →

T1105 Ingress Tool Transfer primary impact

DET0060 Detect Ingress Tool Transfers via Behavioral Chain
AN0165 Windows
Unusual or uncommon processes initiate network connections to external destinations followed by file creation (tools downloaded).

WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: ParentProcessName DestinationIPCategory FilePathRegex

AN0166 Linux
Shell-based tools (curl, wget, scp) initiate connections to external domains followed by creation of executable files on disk.

auditd:SYSCALL connect, execve, write → DC0064 Command Execution
auditd:SYSCALL file creation/modification → DC0039 File Creation
iptables:LOG TCP connections → DC0078 Network Traffic Flow

Tunable: ToolName DownloadExtension

AN0167 macOS
Process execution of curl or wget followed by a network connection and a file created in temporary or user-specific directories.

macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC → DC0032 Process Creation
macos:unifiedlog file write/create → DC0039 File Creation
macos:unifiedlog connection open → DC0082 Network Connection Creation

Tunable: DirectoryTargeted ProcessPath

AN0168 ESXi
Command line interface or vCLI triggers remote transfer using wget or curl, writing files into datastore paths or local tmp directories.

esxi:hostd command execution → DC0064 Command Execution
esxi:vmkernel file write → DC0039 File Creation

Tunable: ToolName DatastorePath

AN0169 Network Devices
Network device logs show anomalous inbound file transfers or uncharacteristic flows with high payload volume to network devices with storage or automation hooks.

NSM:Flow connection metadata → DC0078 Network Traffic Flow
snmp:syslog firmware write/log event → DC0039 File Creation

Tunable: PayloadVolumeThreshold ProtocolUsed

Sigma rules tagged `attack.t1105` (87)

Suspicious Curl File Upload - Linux mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update) · 2022-09-15 (modified 2023-05-02) · logsource: product=linux category=process_creation · 00b90cc1-17ec-402c-96ad-3a8117d7a582

Detects a suspicious curl process start the adds a file to a web request

Techniques: T1567 T1105

Potential Data Exfiltration Via Curl.EXE mediumtest

Author: Florian Roth (Nextron Systems), Cedric MAURUGEON (Update) · 2020-07-03 (modified 2023-05-02) · logsource: product=windows category=process_creation · 00bca14a-df4e-4649-9054-3f2aa676bc04

Detects the execution of the "curl" process with "upload" flags. Which might indicate potential data exfiltration

Techniques: T1567 T1105

Suspicious Download from Office Domain hightest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2021-12-27 (modified 2022-08-02) · logsource: product=windows category=process_creation · 00d49ed5-4491-4271-a8db-650a4ef6f8c1

Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents

Techniques: T1105 T1608

Potential COM Objects Download Cradles Usage - Process Creation mediumtest

Author: frack113 · 2022-12-25 · logsource: product=windows category=process_creation · 02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

Techniques: T1105

Insensitive Subfolder Search Via Findstr.EXE lowtest

Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) · 2020-10-05 (modified 2024-03-05) · logsource: product=windows category=process_creation · 04936b66-3915-43ad-a8e5-809eadfd1141

Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.

Techniques: T1218 T1564.004 T1552.001 T1105

Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-06-13 · logsource: product=windows category=image_load · 04fc4b22-91a6-495a-879d-0144fec5ec03

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from attacker-controlled WebDAV servers loading the Windows system DLLs like gdi32.dll, netapi32.dll, etc.

Techniques: T1218 T1105

CVE tags: CVE-2025-33053

Local Network Connection Initiated By Script Interpreter mediumtest

Author: frack113 · 2022-08-28 (modified 2024-05-31) · logsource: product=windows category=network_connection · 08249dc0-a28d-4555-8ba5-9255a198e08c

Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.

Techniques: T1105

Axios NPM Compromise Indicators - Linux highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-04-01 · logsource: product=linux category=process_creation · 0a23a62d-c5b3-468b-a072-25064a9a8c87

Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.

Techniques: T1195.002 T1059.006 T1059.004 T1105

Uncommon Network Connection Initiated By Certutil.EXE hightest

Author: frack113, Florian Roth (Nextron Systems) · 2022-09-02 (modified 2024-05-31) · logsource: product=windows category=network_connection · 0dba975d-a193-4ed1-a067-424df57570d1

Detects a network connection initiated by the certutil.exe utility. Attackers can abuse the utility in order to download malware or additional payloads.

Techniques: T1105

File Download with Headless Browser hightest

Author: Sreeman, Florian Roth (Nextron Systems) · 2022-01-04 (modified 2025-10-07) · logsource: product=windows category=process_creation · 0e8cfe08-02c9-4815-a2f8-0d157b7ed33e

Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files

Techniques: T1105 T1564.003

Potential DLL File Download Via PowerShell Invoke-WebRequest mediumtest

Author: Florian Roth (Nextron Systems), Hieu Tran · 2023-03-13 (modified 2025-07-18) · logsource: product=windows category=process_creation · 0f0450f3-8b47-441e-a31b-15a91dc243e2

Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.

Techniques: T1059.001 T1105

Potential In-Memory Download And Compile Of Payloads mediumtest

Author: Sohan G (D4rkCiph3r), Red Canary (idea) · 2023-08-22 · logsource: product=macos category=process_creation · 13db8d2e-7723-4c2c-93c1-a4d36994f7ef

Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware

Techniques: T1059.007 T1105

Suspicious File Downloaded From Direct IP Via Certutil.EXE hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-02-15 (modified 2025-12-01) · logsource: product=windows category=process_creation · 13e6fe51-d478-4c7e-b0f2-6da9b400a829

Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.

Techniques: T1027 T1105

Suspicious Diantz Download and Compress Into a CAB File mediumtest

Author: frack113 · 2021-11-26 (modified 2022-08-13) · logsource: product=windows category=process_creation · 185d7418-f250-42d0-b72e-0c8b70661e93

Download and compress a remote file and store it in a cab file on local machine.

Techniques: T1105

Download from Suspicious Dyndns Hosts mediumtest

Author: Florian Roth (Nextron Systems) · 2017-11-08 (modified 2023-05-18) · logsource: category=proxy · 195c1119-ef07-4909-bb12-e66f5e07bf3c

Detects download of certain file types from hosts with dynamic DNS names (selected list)

Techniques: T1105 T1568

All 87 rules on the technique page →

T1203 Exploitation for Client Execution exploitation technique

DET0287 Exploitation for Client Execution – cross-platform behavior chain (browser/Office/3rd-party apps)
AN0797 Windows
Cause→effect chain: (1) A client app (browser, Office, PDF/Flash/reader) experiences a crash/abnormal exit or loads from an unusual location, then (2) drops or modifies a file in user-writable paths, and/or (3) spawns an unexpected child (e.g., powershell/cmd/mshta/rundll32/wscript/installer), and (4) establishes outbound C2-like connections shortly after. Correlate application logs, file writes, process lineage, and network egress within a short window.

WinEventLog:Application EventCode=1000 → DC0038 Application Log Content
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: TimeWindow HighRiskChildren UserPaths AllowedPlugins EgressAllowlist

AN0798 Linux
Cause→effect chain: (1) Browser/Office/reader process logs crash/segfault or abnormal sandbox message, (2) new executable/script/write occurs in $HOME (Downloads, ~/.cache, /tmp), (3) unexpected child like curl/wget/bash/python opens network connections soon after.

linux:syslog browser/office crash, segfault, abnormal termination → DC0038 Application Log Content
auditd:SYSCALL open → DC0055 File Access
auditd:SYSCALL creat → DC0039 File Creation
auditd:SYSCALL rename,chmod → DC0061 File Modification
auditd:SYSCALL execve → DC0032 Process Creation
NetFlow:Flow new outbound connections from exploited process tree → DC0078 Network Traffic Flow

Tunable: TimeWindow UserPaths HighRiskChildren PackageUpdaters

AN0799 macOS
Cause→effect chain: (1) App crash/abnormal termination in unified logs for Safari/Chrome/Office/Preview, (2) new files/scripts in ~/Library, ~/Downloads, /private/var/folders/*, (3) unexpected child (osascript, zsh, bash, curl) spawned by those apps, (4) new outbound connections.

macos:unifiedlog process crash, abort, code signing violations → DC0038 Application Log Content
fs:fsevents create/write/rename under user-writable paths → DC0061 File Modification
macos:osquery exec → DC0032 Process Creation
NSM:Connections new connections from exploited lineage → DC0078 Network Traffic Flow

Tunable: TimeWindow HighRiskChildren UserPaths QuarantineBypass

Sigma rules tagged `attack.t1203` (35)

Download From Suspicious TLD - Blacklist lowtest

Author: Florian Roth (Nextron Systems) · 2017-11-07 (modified 2023-05-18) · logsource: category=proxy · 00d0b5ab-1f55-4120-8e83-487c0a7baf19

Detects download of certain file types from hosts in suspicious TLDs

Techniques: T1566 T1203 T1204.002

Suspicious HWP Sub Processes hightest

Author: Florian Roth (Nextron Systems) · 2019-10-24 (modified 2021-11-27) · logsource: product=windows category=process_creation · 023394c4-29d5-46ab-92b8-6a534c6f447b

Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation

Techniques: T1566.001 T1203 T1059.003

Suspicious Browser Child Process - MacOS mediumtest

Author: Sohan G (D4rkCiph3r) · 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6

Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.

Techniques: T1189 T1203 T1059

Antivirus - APT Malware Signature criticalexperimental

Author: Arnim Rupp (Nextron Systems) · 2026-06-15 · logsource: category=antivirus · 101a1877-2cf4-474d-abfd-7f6ac4788d1a

Detects a highly relevant Antivirus alert that reports APT malware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Techniques: T1203 T1219.002

Potentially Suspicious Child Process Of WinRAR.EXE mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-08-31 · logsource: product=windows category=process_creation · 146aace8-9bd6-42ba-be7a-0070d8027b76

Detects potentially suspicious child processes of WinRAR.exe.

Techniques: T1203

OMIGOD SCX RunAsProvider ExecuteShellCommand hightest

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC · 2021-10-15 (modified 2022-10-05) · logsource: product=linux category=process_creation · 21541900-27a9-4454-9c4c-3f0a4240344a

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

Techniques: T1068 T1190 T1203

Antivirus - Exploitation Framework Signature criticalstable

Author: Florian Roth (Nextron Systems), Arnim Rupp · 2018-09-09 (modified 2026-06-15) · logsource: category=antivirus · 238527ad-3c2c-4e4f-a1f6-92fd63adb864

Detects a highly relevant Antivirus alert that reports an exploitation framework. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Techniques: T1203 T1219.002

Suspicious Invocation of Shell via Rsync highexperimental

Author: Florian Roth · 2025-01-18 · logsource: product=linux category=process_creation · 297241f3-8108-4b3a-8c15-2dda9f844594

Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.

Techniques: T1059 T1203

CVE-2021-31979 CVE-2021-33771 Exploits criticaltest

Author: Sittikorn S, frack113 · 2021-07-16 (modified 2023-08-17) · logsource: product=windows category=registry_set · 32b5db62-cb5f-4266-9639-0fa48376ac00

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

Techniques: T1566 T1203

CVE tags: CVE-2021-33771CVE-2021-31979

Dfsvc.EXE Network Connection To Non-Local IPs mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-12 (modified 2024-03-12) · logsource: product=windows category=network_connection · 3c21219b-49b5-4268-bce6-c914ed50f09c

Detects network connections from "dfsvc.exe" used to handled ClickOnce applications to non-local IPs

Techniques: T1203

Potential Exploitation of CVE-2025-4427/4428 Ivanti EPMM Pre-Auth RCE highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-05-20 · logsource: category=webserver · 41956f7c-7a6b-46d6-b6bb-da6eb2e83fbe

Detects potential exploitation of a chained vulnerability attack targeting Ivanti EPMM 12.5.0.0. CVE-2025-4427 allows unauthenticated access to protected API endpoints via an authentication bypass, which can then be leveraged to trigger CVE-2025-4428 — a remote code execution vulnerability through template injection. This sequence enables unauthenticated remote code execution, significantly increasing the impact of exploitation.

Techniques: T1190 T1203

CVE tags: CVE-2025-4427CVE-2025-4428

Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process highexperimental

Author: Huntress Labs, Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-10-31 · logsource: product=windows category=process_creation · 43259cc4-1b80-4931-bd98-baea01afc196

Detects the creation of command-line interpreters (cmd.exe, powershell.exe) as child processes of Windows Server Update Services (WSUS) related process wsusservice.exe. This behavior is a key indicator of exploitation for the critical remote code execution vulnerability such as CVE-2025-59287, where attackers spawn shells to conduct reconnaissance and further post-exploitation activities.

Techniques: T1190 T1203

CVE tags: CVE-2025-59287

Audit CVE Event criticaltest

Author: Florian Roth (Nextron Systems), Zach Mathis · 2020-01-15 (modified 2022-10-22) · logsource: product=windows service=application · 48d91a3a-2363-43ba-a456-ca71ac3da5c2

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

Techniques: T1203 T1068 T1211 T1212 T1210 T1499.004

Dfsvc.EXE Initiated Network Connection Over Uncommon Port hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-12 (modified 2024-01-31) · logsource: product=windows category=network_connection · 4c5fba4a-9ef6-4f16-823d-606246054741

Detects an initiated network connection over uncommon ports from "dfsvc.exe". A utility used to handled ClickOnce applications.

Techniques: T1203

Shai-Hulud Malicious Bun Execution highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-25 · logsource: product=windows category=process_creation · 5299fadf-f228-4526-8274-251db1960be9

Detects the execution of `bun_environment.js` via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack. The malware uses a `setup_bun.js` script to install the Bun runtime if not present, and then executes the malicious `bun_environment.js` payload.

Techniques: T1195.002 T1203

All 35 rules on the technique page →

T1204.001 Malicious Link exploitation technique

DET0066 User Execution – Malicious Link (click → suspicious egress → download/write → follow-on activity)
AN0178 Windows
Behavioral chain: (1) a user-facing app (browser/Office/email client) launches a URL or handles a link, then (2) the same process lineage makes an outbound connection to an untrusted domain/IP, (3) a file is downloaded or unpacked to a user-writable location shortly after the click. Optional enrichment: subsequent child execution by LOLBINs.

WinEventLog:Security EventCode=4688 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
NSM:Flow Suspicious URL patterns, uncommon TLDs, short-lived domains, URL shorteners; HTTP method GET/POST → DC0085 Network Traffic Content

Tunable: TimeWindow BrowserParents UserPaths SuspiciousTLDs AllowedCDNs

AN0179 Linux
Behavioral chain: (1) browser/office/GUI mail client opens a URL, (2) outbound connection to untrusted domain, (3) a new file is saved in $HOME/Downloads, /tmp, or cache immediately after.

auditd:SYSCALL execve: Execs of chromium, google-chrome, firefox, libreoffice with http(s) in cmdline → DC0082 Network Connection Creation
auditd:SYSCALL open,creat,rename: Writes in $HOME/Downloads, /tmp, ~/.cache with exe/script/archive/office extensions → DC0039 File Creation
NSM:Flow Suspicious URL patterns, uncommon TLDs, URL shorteners → DC0085 Network Traffic Content

Tunable: TimeWindow UserPaths HighRiskExtensions DomainRiskScore

AN0180 macOS
Behavioral chain: (1) Safari/Chrome/Firefox/Office handles a URL; unified logs show open/click or LSQuarantine assignment, (2) outbound connection to untrusted domain, (3) a new file appears in ~/Downloads or /private/var/folders/* with quarantine flag.

macos:unifiedlog open URL|clicked link|LSQuarantineAttach → DC0085 Network Traffic Content
NSM:Connections New outbound connection from Safari/Chrome/Firefox/Word → DC0082 Network Connection Creation
fs:fsevents Create in /Users/*/Downloads or /private/var/folders/* with quarantine attribute → DC0039 File Creation

Tunable: TimeWindow QuarantinePolicy SuspiciousTLDs

Sigma rules tagged `attack.t1204.001` (4)

Suspicious Execution via macOS Script Editor mediumtest

Author: Tim Rauch (rule), Elastic (idea) · 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4

Detects when the macOS Script Editor utility spawns an unusual child process.

Techniques: T1566 T1566.002 T1059 T1059.002 T1204 T1204.001 T1553

Symlink Etc Passwd hightest

Author: Florian Roth (Nextron Systems) · 2019-04-05 (modified 2021-11-27) · logsource: product=linux · c67fc22a-0be5-4b4f-aad5-2b32c4b69523

Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd

Techniques: T1204.001

Suspicious ClickFix/FileFix Execution Pattern highexperimental

Author: montysecurity, Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-19 · logsource: product=windows category=process_creation · d487ed4a-fd24-436d-a0b2-f4e95f7b2635

Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation, either through the Windows Run dialog (ClickFix) or File Explorer address bar (FileFix). Attackers leverage social engineering campaigns—such as fake CAPTCHA challenges or urgent alerts—encouraging victims to paste clipboard contents, often executing mshta.exe, powershell.exe, or similar commands to infect systems.

Techniques: T1204.001 T1204.004

Potential ClickFix Execution Pattern - Registry highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-03-25 (modified 2025-11-19) · logsource: product=windows category=registry_set · f5fe36cf-f1ec-4c23-903d-09a3110f6bbb

Detects potential ClickFix malware execution patterns by monitoring registry modifications in RunMRU keys containing HTTP/HTTPS links. ClickFix is known to be distributed through phishing campaigns and uses techniques like clipboard hijacking and fake CAPTCHA pages. Through the fakecaptcha pages, the adversary tricks users into opening the Run dialog box and pasting clipboard-hijacked content, such as one-liners that execute remotely hosted malicious files or scripts.

Techniques: T1204.001

T1566.002 Spearphishing Link exploitation technique

DET0107 Detection Strategy for Spearphishing Links
AN0298 Windows
Correlation of inbound emails with embedded links followed by user-driven browser navigation to suspicious or obfuscated domains. Detection chain includes malicious URL in email → user click recorded in Office logs → browser process spawning unusual child processes (e.g., PowerShell, cmd) or download activity.

m365:unified Send/Receive: Inbound emails containing embedded or shortened URLs → DC0038 Application Log Content
WinEventLog:Security EventCode=4688 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: SuspiciousTLDs URLShortenerDomains ClickToExecutionWindow

AN0299 Linux
Detection of spearphishing links through mail logs and browser activity. Behavior includes email with suspicious URLs → user click recorded in mail/web proxy logs → shell or interpreter launched from browser process.

Application:Mail Inbound emails containing hyperlinks from suspicious sources → DC0038 Application Log Content
auditd:SYSCALL execve: Execution of scripts or binaries spawned from browser processes → DC0032 Process Creation
NSM:Flow Outbound requests to domains not previously resolved or associated with phishing campaigns → DC0078 Network Traffic Flow

Tunable: MonitoredBrowsers PhishingIndicators

AN0300 macOS
Correlation of Mail.app logs with Safari/Chrome activity. Suspicious behavior includes email links → Safari/Chrome accessing newly registered or lookalike domains → osascript or Terminal spawned unexpectedly.

macos:unifiedlog Received messages with embedded or shortened URLs → DC0038 Application Log Content
macos:unifiedlog Browser processes launching unexpected interpreters (osascript, bash) → DC0032 Process Creation
macos:unifiedlog Connections to suspicious domains with mismatched certificate or unusual patterns → DC0085 Network Traffic Content

Tunable: CertificateAnomalies ExecutionDelayThreshold

AN0301 Identity Provider
Detection of OAuth consent phishing or malicious login attempts initiated through spearphishing links. Behavior chain includes inbound email with OAuth URL → consent page visited → unusual token grants logged in IdP logs.

azure:signinlogs ConsentGrant: Suspicious consent grants to non-approved or unknown applications → DC0038 Application Log Content

Tunable: AllowedApps AnomalousConsentPatterns

Sigma rules tagged `attack.t1566.002` (4)

Suspicious Email Delivered In Microsoft 365 mediumexperimental

Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) · 2026-01-27 · logsource: product=m365 service=audit · 3569aefd-e535-4391-8c18-24bd01a21eaf

Detects instances where an email, identified as malicious or suspicious by the Microsoft Defender for Office 365 (formerly ATP) engine, was delivered to a user's Inbox or Junk folder. It might indicate that a potential threat, such as a spearphishing attachment or links, has bypassed initial blocking mechanisms and reached an end-user, requiring further investigation and potential remediation.

Techniques: T1566.001 T1566.002

Potential Malicious Usage of CloudTrail System Manager hightest

Author: jamesc-grafana · 2024-07-11 (modified 2025-12-08) · logsource: product=aws service=cloudtrail · 38e7f511-3f74-41d4-836e-f57dfa18eead

Detect when System Manager successfully executes commands against an instance.

Techniques: T1566 T1566.002

Suspicious Execution via macOS Script Editor mediumtest

Author: Tim Rauch (rule), Elastic (idea) · 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4

Detects when the macOS Script Editor utility spawns an unusual child process.

Techniques: T1566 T1566.002 T1059 T1059.002 T1204 T1204.001 T1553

EvilTokens PhaaS Kit Phishing Related Request - Proxy lowexperimental

Author: uniqu3-us3r · 2026-04-28 · logsource: category=proxy · e0e121d0-be4d-4281-af7e-17abbba4a408

Detects outbound web proxy requests to URLs matching the EvilTokens Phishing-as-a-Service (PhaaS) kit infrastructure. Specifically Cloudflare Workers and Railway.app domains used in OAuth device code authorization phishing attacks. This indicates a user has clicked a phishing link.

Techniques: T1566.002

CVE-2015-5119 Mapped Sigma

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1055.001 Dynamic-link Library Injection secondary impact

Sigma rules tagged attack.t1055.001 (8)

T1059.007 JavaScript exploitation technique

Sigma rules tagged attack.t1059.007 (29)

T1071.001 Web Protocols secondary impact

Sigma rules tagged attack.t1071.001 (42)

T1105 Ingress Tool Transfer primary impact

Sigma rules tagged attack.t1105 (87)

T1203 Exploitation for Client Execution exploitation technique

Sigma rules tagged attack.t1203 (35)

T1204.001 Malicious Link exploitation technique

Sigma rules tagged attack.t1204.001 (4)

T1566.002 Spearphishing Link exploitation technique

Sigma rules tagged attack.t1566.002 (4)

Sigma rules tagged `attack.t1055.001` (8)

Sigma rules tagged `attack.t1059.007` (29)

Sigma rules tagged `attack.t1071.001` (42)

Sigma rules tagged `attack.t1105` (87)

Sigma rules tagged `attack.t1203` (35)

Sigma rules tagged `attack.t1204.001` (4)

Sigma rules tagged `attack.t1566.002` (4)