T1204.002 Malicious File

execution — Linux, macOS, Windows · attack.mitre.org · JSON

MITRE detection strategy

analytics

Sigma rules tagged attack.t1204.002

KEV CVEs mapped here

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.Adversaries may employ various forms of Masquerading and Obfuscated Files or Information to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it.While Malicious File frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing.

KEV CVEs mapped to this technique · CTID Mappings Explorer

CVE	Vendor / product	Mapping type	State	Added
CVE-2025-27363	FreeType FreeType	exploitation technique	Mapped	2025-05-06
CVE-2024-38080	Microsoft Windows	exploitation technique	Mapped	2024-07-09
CVE-2023-21608	Adobe Acrobat and Reader	exploitation technique	Mapped	2023-10-10
CVE-2023-26369	Adobe Acrobat and Reader	exploitation technique	Mapped	2023-09-14
CVE-2023-36884	Microsoft Windows	primary impact	Stale	2023-07-17
CVE-2023-21715	Microsoft Office	exploitation technique	Mapped	2023-02-14
CVE-2022-34713	Microsoft Windows	primary impact	Mapped	2022-08-09
CVE-2022-30190	Microsoft Windows	exploitation technique	Mapped	2022-06-14
CVE-2018-4990	Adobe Acrobat and Reader	exploitation technique	Mapped	2022-06-08
CVE-2012-0754	Adobe Flash Player	exploitation technique	Mapped	2022-06-08
CVE-2011-2462	Adobe Reader and Acrobat	exploitation technique	Mapped	2022-06-08
CVE-2010-2883	Adobe Acrobat and Reader	exploitation technique	Mapped	2022-06-08
CVE-2010-1297	Adobe Flash Player	exploitation technique	Mapped	2022-06-08
CVE-2009-4324	Adobe Acrobat and Reader	exploitation technique	Mapped	2022-06-08
CVE-2009-3953	Adobe Acrobat and Reader	exploitation technique	Mapped	2022-06-08
CVE-2009-1862	Adobe Acrobat and Reader, Flash Player	exploitation technique	Mapped	2022-06-08
CVE-2008-0655	Adobe Acrobat and Reader	exploitation technique	Mapped	2022-06-08
CVE-2007-5659	Adobe Acrobat and Reader	exploitation technique	Mapped	2022-06-08
CVE-2016-0984	Adobe Flash Player and AIR	exploitation technique	Mapped	2022-05-25
CVE-2015-3113	Adobe Flash Player	exploitation technique	Mapped	2022-04-13
CVE-2017-11292	Adobe Flash Player	exploitation technique	Mapped	2022-03-03
CVE-2016-4117	Adobe Flash Player	exploitation technique	Mapped	2022-03-03
CVE-2015-7645	Adobe Flash Player	exploitation technique	Mapped	2022-03-03
CVE-2015-3043	Adobe Flash Player	exploitation technique	Mapped	2022-03-03
CVE-2014-0496	Adobe Reader and Acrobat	exploitation technique	Mapped	2022-03-03
CVE-2013-0641	Adobe Reader	exploitation technique	Mapped	2022-03-03
CVE-2012-1535	Adobe Flash Player	exploitation technique	Mapped	2022-03-03
CVE-2011-0611	Adobe Flash Player	exploitation technique	Mapped	2022-03-03
CVE-2008-2992	Adobe Acrobat and Reader	exploitation technique	Mapped	2022-03-03
CVE-2018-15982	Adobe Flash Player	exploitation technique	Mapped	2022-02-15
CVE-2021-21017	Adobe Acrobat and Reader	exploitation technique	Mapped	2021-11-03
CVE-2021-28550	Adobe Acrobat and Reader	exploitation technique	Mapped	2021-11-03
CVE-2018-4878	Adobe Flash Player	exploitation technique	Mapped	2021-11-03

Detection strategy · ATT&CK Enterprise v19.2

DET0294 User Execution – Malicious File via download/open → spawn chain (T1204.002) v1.0
AN0819 Windows
User opens a file delivered by email, web, chat, or share. The handler application (Word/PDF reader/archiver) creates a file in user-controlled paths (Downloads, Temp, Desktop) and then spawns a new or unusual child process (e.g., powershell.exe, wscript.exe, cmd.exe, regsvr32.exe, rundll32.exe, msiexec.exe). Optional precursors include FileStreamCreated (URL/UNC) and Office → system32 batch writes.

WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=15 → DC0059 File Metadata

Tunable: TimeWindow SuspiciousExtensions UserPaths ParentApps SignerAllowList

AN0820 macOS
User opens a downloaded document/installer leading to EndpointSecurity file create in ~/Downloads or ~/Library paths then an exec of a suspicious utility (osascript, bash/zsh, curl, chmod, open with -a Terminal). Correlates File Creation with subsequent process exec and, optionally, quarantine/LSQuarantine events.

macos:unifiedlog process_exec: image in {/bin/bash,/bin/zsh,/usr/bin/osascript,/usr/bin/python*,/usr/bin/curl,/usr/bin/ssh,/usr/bin/open} AND parent in {Preview, TextEdit, Microsoft Word, Microsoft Excel, AdobeReader, Archive Utility, Finder} → DC0032 Process Creation
macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_CREATE: path under /Users/*/(Downloads|Desktop|Library/*/Containers|Library/Group Containers) AND extension in SuspiciousExtensions → DC0039 File Creation

Tunable: TimeWindow QuarantineRequired ParentApps

AN0821 Linux
User or desktop application writes a new file to ~/Downloads, /tmp, or mounted removable media followed by execve of a risky interpreter/loader (bash, sh, python, perl, php, node, curl|wget piping to sh, ld.so, rdesktop, xdg-open - with unusual args). Uses auditd PATH+SYSCALL (open/creat/write/rename) with execve event linking.

auditd:SYSCALL open/create/rename: name in (/home/*/Downloads/*|/tmp/*|/run/user/*|/media/*) AND ext in SuspiciousExtensions → DC0039 File Creation
auditd:SYSCALL execve: exe in {/bin/bash,/bin/sh,/usr/bin/python*,/usr/bin/perl,/usr/bin/php,/usr/bin/node,/usr/bin/curl,/usr/bin/wget,/usr/bin/xdg-open,/usr/bin/ssh,/usr/bin/rundll32 (wine)} AND ppid process is a document viewer/browser → DC0032 Process Creation

Tunable: TimeWindow DesktopParentMap

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1204.002`

Download From Suspicious TLD - Blacklist lowtest

Author: Florian Roth (Nextron Systems) · 2017-11-07 (modified 2023-05-18) · logsource: category=proxy · 00d0b5ab-1f55-4120-8e83-487c0a7baf19

Detects download of certain file types from hosts in suspicious TLDs

Potential Suspicious Browser Launch From Document Reader Process mediumtest

Author: Joseph Kamau · 2024-05-27 (modified 2025-10-07) · logsource: product=windows category=process_creation · 1193d960-2369-499f-a158-7b50a31df682

Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc. And connects to a web application over http(s), this could indicate a possible phishing attempt.

Techniques: T1204.002

Microsoft Word Add-In Loaded lowtest

Author: Steffen Rogge (dr0pd34d) · 2024-07-10 · logsource: product=windows category=image_load · 1337afba-d17d-4d23-bd55-29b927603b30

Detects Microsoft Word loading an Add-In (.wll) file which can be used by threat actors for initial access or persistence.

Techniques: T1204.002

Suspicious Outlook Child Process hightest

Author: Michael Haag, Florian Roth (Nextron Systems), Markus Neis, Elastic, FPT.EagleEye Team · 2022-02-28 (modified 2023-02-04) · logsource: product=windows category=process_creation · 208748f7-881d-47ac-a29c-07ea84bf691d

Detects a suspicious process spawning from an Outlook process.

Techniques: T1204.002

Suspicious Startup Folder Persistence hightest

Author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) · 2022-08-10 (modified 2025-10-12) · logsource: product=windows category=file_event · 28208707-fe31-437f-9a7f-4b1108b94d2e

Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common persistence technique used by threat actors. These files (.ps1, .vbs, .js, .bat, etc.) are automatically executed when a user logs in, making the Startup folder an attractive target for attackers. This technique is frequently observed in malvertising campaigns and malware distribution where attackers attempt to maintain long-term access to compromised systems.

Techniques: T1204.002 T1547.001

Successful MSIX/AppX Package Installation lowexperimental

Author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-03 · logsource: product=windows service=appxdeployment-server · 289dfa9e-e378-4a56-a9d4-7ed5ee218029

Detects successful MSIX/AppX package installations on Windows systems by monitoring EventID 854 in the Microsoft-Windows-AppXDeployment-Server/Operational log. While most installations are legitimate, this can help identify unauthorized or suspicious package installations. It is crucial to monitor such events as threat actors may exploit MSIX/AppX packages to deliver and execute malicious payloads.

Techniques: T1204.002

Potential Maze Ransomware Activity criticaltest

Author: Florian Roth (Nextron Systems) · 2020-05-08 (modified 2023-02-13) · logsource: product=windows category=process_creation · 29fd07fc-9cfd-4331-b7fd-cc18dfa21052

Detects specific process characteristics of Maze ransomware word document droppers

Techniques: T1204.002 T1047 T1490

TanStack Supply-Chain Attack Execution Indicators - Linux highexperimental

Author: Leonardo Gasparini · 2026-05-12 · logsource: product=linux category=process_creation · 3c6f5e4a-8d0b-6abc-d9e2-4f7a6b8c9d0e

Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026. The preinstall hook runs setup.mjs, which downloads a platform-specific Bun runtime.

Techniques: T1059.007 T1059.006 T1204.002

AppLocker Prevented Application or Script from Running mediumtest

Author: Pushkarev Dmitry · 2020-06-28 (modified 2025-12-03) · logsource: product=windows service=applocker · 401e5d00-b944-11ea-8f9a-00163ecd60ae

Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.

Techniques: T1204.002 T1059.001 T1059.003 T1059.005 T1059.006 T1059.007

Suspicious Microsoft Office Child Process hightest

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io · 2018-04-06 (modified 2023-04-24) · logsource: product=windows category=process_creation · 438025f9-5856-4663-83f7-52f878a70a50

Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)

Techniques: T1047 T1204.002 T1218.010

Flash Player Update from Suspicious Location hightest

Author: Florian Roth (Nextron Systems) · 2017-10-25 (modified 2022-08-08) · logsource: category=proxy · 4922a5dd-6743-4fc2-8e81-144374280997

Detects a flashplayer update from an unofficial location

Techniques: T1189 T1204.002 T1036.005

AppLocker Application Would Have Been Blocked mediumexperimental

Author: heyyanu · 2026-03-26 · logsource: product=windows service=applocker · 557e3bd3-7f21-495d-8d50-7c8bdfb8041c

Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.

Techniques: T1204.002 T1059.001 T1059.003 T1059.005 T1059.006 T1059.007

New Application in AppCompat informationaltest

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) · 2020-05-02 (modified 2023-08-17) · logsource: product=windows category=registry_set · 60936b49-fca0-4f32-993d-7415edcf9a5d

A General detection for a new application in AppCompat. This indicates an application executing for the first time on an endpoint.

Techniques: T1204.002

Droppers Exploiting CVE-2017-11882 criticalstable

Author: Florian Roth (Nextron Systems) · 2017-11-23 (modified 2021-11-27) · logsource: product=windows category=process_creation · 678eb5f4-8597-4be6-8be7-905e4234b53a

Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe

Techniques: T1203 T1204.002 T1566.001

CVE tags: CVE-2017-11882

Suspicious Microsoft Office Child Process - MacOS hightest

Author: Sohan G (D4rkCiph3r) · 2023-01-31 (modified 2023-02-04) · logsource: product=macos category=process_creation · 69483748-1525-4a6c-95ca-90dc8d431b68

Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution

Techniques: T1059.002 T1137.002 T1204.002

HackTool - LittleCorporal Generated Maldoc Injection hightest

Author: Christian Burkard (Nextron Systems) · 2021-08-09 (modified 2023-11-28) · logsource: product=windows category=process_access · 7bdde3bf-2a42-4c39-aa31-a92b3e17afac

Detects the process injection of a LittleCorporal generated Maldoc.

Techniques: T1204.002 T1055.003

Exploit for CVE-2017-0261 mediumtest

Author: Florian Roth (Nextron Systems) · 2018-02-22 (modified 2021-11-27) · logsource: product=windows category=process_creation · 864403a1-36c9-40a2-a982-4c9a45f7d833

Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and CVE-2017-0262

Techniques: T1203 T1204.002 T1566.001

CVE tags: CVE-2017-0261

Suspicious WmiPrvSE Child Process hightest

Author: Vadim Khrykov (ThreatIntel), Cyb3rEng, Florian Roth (Nextron Systems) · 2021-08-23 (modified 2023-11-10) · logsource: product=windows category=process_creation · 8a582fe2-0882-4b89-a82a-da6b2dc32937

Detects suspicious and uncommon child processes of WmiPrvSE

Techniques: T1047 T1204.002 T1218.010

GAC DLL Loaded Via Office Applications hightest

Author: Antonlovesdnb · 2020-02-19 (modified 2023-02-10) · logsource: product=windows category=image_load · 90217a70-13fc-48e4-b3db-0d836c5824ac

Detects any GAC DLL being loaded by an Office Product

Techniques: T1204.002

Ursnif Malware C2 URL Pattern criticalstable

Author: Thomas Patzke · 2019-12-19 (modified 2021-08-09) · logsource: category=proxy · 932ac737-33ca-4afd-9869-0d48b391fcc9

Detects Ursnif C2 traffic.

Techniques: T1566.001 T1204.002 T1071.001

Windows AppX Deployment Unsigned Package Installation mediumexperimental

Author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-03 · logsource: product=windows service=appxdeployment-server · 9a025188-6f2d-42f8-bb2f-d3a83d24a5af

Detects attempts to install unsigned MSIX/AppX packages using the -AllowUnsigned parameter via AppXDeployment-Server events

Techniques: T1204.002 T1553.005

Microsoft VBA For Outlook Addin Loaded Via Outlook mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-02-08 (modified 2024-03-12) · logsource: product=windows category=image_load · 9a0b8719-cd3c-4f0a-90de-765a4cb3f5ed

Detects outlvba (Microsoft VBA for Outlook Addin) DLL being loaded by the outlook process

Techniques: T1204.002

TanStack Supply-Chain Attack Execution Indicators - Windows highexperimental

Author: Leonardo Gasparini · 2026-05-12 · logsource: product=windows category=process_creation · 9b4f3d2e-6e8c-5fab-c7d9-2a3b4e5f6a7b

Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai, uipath reported on early May 2026.

Techniques: T1059.007 T1204.002

MMC Executing Files with Reversed Extensions Using RTLO Abuse highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-02-05 · logsource: product=windows category=process_creation · 9cfe4b27-1e56-48b4-b7a8-d46851c91a44

Detects malicious behavior where the MMC utility (`mmc.exe`) executes files with reversed extensions caused by Right-to-Left Override (RLO) abuse, disguising them as document formats.

Techniques: T1204.002 T1218.014 T1036.002

Kapeka Backdoor Loaded Via Rundll32.EXE hightest

Author: Swachchhanda Shrawan Poudel · 2024-07-03 · logsource: product=windows category=image_load · a7e6b1f9-8d2c-4f1e-9a7d-63e4c8a2bf4c

Detects the Kapeka Backdoor binary being loaded by rundll32.exe. The Kapeka loader drops a backdoor, which is a DLL with the '.wll' extension masquerading as a Microsoft Word Add-In.

Techniques: T1204.002 T1218.011

Suspicious Binary In User Directory Spawned From Office Application hightest

Author: Jason Lynch · 2019-04-02 (modified 2023-02-04) · logsource: product=windows category=process_creation · aa3a6f94-890e-4e22-b634-ffdfd54792cc

Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio)

Techniques: T1204.002

Microsoft Excel Add-In Loaded From Uncommon Location mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-05-12 · logsource: product=windows category=image_load · af4c4609-5755-42fe-8075-4effb49f5d44

Detects Microsoft Excel loading an Add-In (.xll) file from an uncommon location

Techniques: T1204.002

Windows MSIX Package Support Framework AI_STUBS Execution lowexperimental

Author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-03 · logsource: product=windows category=process_creation · af5732ed-764e-489d-826d-0447c8b36242

Detects execution of Advanced Installer MSIX Package Support Framework (PSF) components, specifically AI_STUBS executables with original filename 'popupwrapper.exe'. This activity may indicate malicious MSIX packages build with Advanced Installer leveraging the Package Support Framework to bypass application control restrictions.

Techniques: T1218 T1553.005 T1204.002

Download From Suspicious TLD - Whitelist lowtest

Author: Florian Roth (Nextron Systems) · 2017-03-13 (modified 2023-05-18) · logsource: category=proxy · b5de2919-b74a-4805-91a7-5049accbaefe

Detects executable downloads from suspicious remote systems

Techniques: T1566 T1203 T1204.002

Microsoft Excel Add-In Loaded lowtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-05-12 · logsource: product=windows category=image_load · c5f4b5cb-4c25-4249-ba91-aa03626e3185

Detects Microsoft Excel loading an Add-In (.xll) file

Techniques: T1204.002

File With Uncommon Extension Created By An Office Application hightest

Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems) · 2021-08-23 (modified 2025-10-17) · logsource: product=windows category=file_event · c7a74c80-ba5a-486e-9974-ab9e682bc5e4

Detects the creation of files with an executable or script extension by an Office application.

Techniques: T1204.002

CLR DLL Loaded Via Office Applications mediumtest

Author: Antonlovesdnb · 2020-02-19 (modified 2023-03-29) · logsource: product=windows category=image_load · d13c43f0-f66b-4279-8b2c-5912077c1780

Detects CLR DLL being loaded by an Office Product

Techniques: T1204.002

Suspicious LNK Command-Line Padding with Whitespace Characters highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-03-19 · logsource: product=windows category=process_creation · dd8756e7-a3a0-4768-b47e-8f545d1a751c

Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260-character UI limit while the actual command-line argument field supports 4096 characters using whitespace padding (e.g., 0x20, 0x09-0x0D). Adversaries insert non-printable whitespace characters (e.g., Line Feed \x0A, Carriage Return \x0D) to pad the visible section of the LNK file, pushing malicious commands past the UI-visible boundary. The hidden payload, executed at runtime but invisible in Windows Explorer properties, enables stealthy execution and evasion—commonly used for social engineering attacks. This rule flags suspicious use of such padding observed in real-world attacks.

Techniques: T1204.002

Suspicious WMIC Execution Via Office Process hightest

Author: Vadim Khrykov, Cyb3rEng · 2021-08-23 (modified 2023-02-14) · logsource: product=windows category=process_creation · e1693bc8-7168-4eab-8718-cdcaa68a1738

Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious parent-child chain (Office app spawns LOLBin).

Techniques: T1204.002 T1047 T1218.010

Windows AppX Deployment Full Trust Package Installation mediumexperimental

Author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-03 · logsource: product=windows service=appxdeployment-server · e54279c7-4910-4e2c-902c-c56a25b549f6

Detects the installation of MSIX/AppX packages with full trust privileges which run with elevated privileges outside normal AppX container restrictions

Techniques: T1204.002 T1553.005

VBA DLL Loaded Via Office Application hightest

Author: Antonlovesdnb · 2020-02-19 (modified 2023-02-10) · logsource: product=windows category=image_load · e6ce8457-68b1-485b-9bdd-3c2b5d679aa9

Detects VB DLL's loaded by an office application. Which could indicate the presence of VBA Macros.

Techniques: T1204.002

Remote DLL Load Via Rundll32.EXE mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-09-18 · logsource: product=windows category=image_load · f40017b3-cb2e-4335-ab5d-3babf679c1de

Detects a remote DLL load event via "rundll32.exe".

Techniques: T1204.002

Exploit for CVE-2017-8759 criticaltest

Author: Florian Roth (Nextron Systems) · 2017-09-15 (modified 2021-11-27) · logsource: product=windows category=process_creation · fdd84c68-a1f6-47c9-9477-920584f94905

Detects Winword starting uncommon sub process csc.exe as used in exploits for CVE-2017-8759

Techniques: T1203 T1204.002 T1566.001

CVE tags: CVE-2017-8759

DotNET Assembly DLL Loaded Via Office Application mediumtest

Author: Antonlovesdnb · 2020-02-19 (modified 2023-03-29) · logsource: product=windows category=image_load · ff0f2b05-09db-4095-b96d-1b75ca24894a

Detects any assembly DLL being loaded by an Office Product

Techniques: T1204.002

Rules tagged at the parent level (attack.t1204) 10

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

Potentially Suspicious WebDAV LNK Execution mediumtest

Author: Micah Babinski · 2023-08-21 · logsource: product=windows category=process_creation · 1412aa78-a24c-4abd-83df-767dfb2c5bbe

Detects possible execution via LNK file accessed on a WebDAV server.

Techniques: T1059.001 T1204

Payload Decoded and Decrypted via Built-in Utilities mediumtest

Author: Tim Rauch (rule), Elastic (idea) · 2022-10-17 · logsource: product=macos category=process_creation · 234dc5df-40b5-49d1-bf53-0d44ce778eca

Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.

Techniques: T1059 T1204 T1140

Arbitrary Shell Command Execution Via Settingcontent-Ms mediumtest

Author: Sreeman · 2020-03-13 (modified 2022-04-14) · logsource: product=windows category=process_creation · 24de4f3b-804c-4165-b442-5a06a2302c7e

The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.

Techniques: T1204 T1566.001

Potential Snatch Ransomware Activity highstable

Author: Florian Roth (Nextron Systems) · 2020-08-26 (modified 2025-10-19) · logsource: product=windows category=process_creation · 5325945e-f1f0-406e-97b8-65104d393fff

Detects specific process characteristics of Snatch ransomware word document droppers

Techniques: T1204

Suspicious Deno File Written from Remote Source lowexperimental

Author: Josh Nickels, Michael Taggart · 2025-05-22 · logsource: product=windows category=file_event · 6c0ce3b6-85e2-49d4-9c3f-6e008ce9796e

Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL. This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.

Techniques: T1204 T1059.007 T1105

Suspicious Execution via macOS Script Editor mediumtest

Author: Tim Rauch (rule), Elastic (idea) · 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4

Detects when the macOS Script Editor utility spawns an unusual child process.

Techniques: T1566 T1566.002 T1059 T1059.002 T1204 T1204.001 T1553

DarkSide Ransomware Pattern criticaltest

Author: Florian Roth (Nextron Systems) · 2021-05-14 · logsource: product=windows category=process_creation · 965fff6c-1d7e-4e25-91fd-cdccd75f7d2c

Detects DarkSide Ransomware and helpers

Techniques: T1204

Suspicious Binaries and Scripts in Public Folder highexperimental

Author: The DFIR Report · 2025-01-23 · logsource: product=windows category=file_event · b447f7de-1e53-4cbf-bfb4-f1f6d0b04e4e

Detects the creation of a file with a suspicious extension in the public folder, which could indicate potential malicious activity.

Techniques: T1204

PrinterNightmare Mimikatz Driver Name criticaltest

Author: Markus Neis, @markus_neis, Florian Roth · 2021-07-04 (modified 2023-06-12) · logsource: product=windows category=registry_event · ba6b9e43-1d45-4d3c-a504-1043a64c8469

Detects static QMS 810 and mimikatz driver name used by Mimikatz as exploited in CVE-2021-1675 and CVE-2021-34527

Techniques: T1204

CVE tags: CVE-2021-1675CVE-2021-34527

Antivirus - Hacktool Signature highstable

Author: Florian Roth (Nextron Systems), Arnim Rupp · 2021-08-16 (modified 2026-06-15) · logsource: category=antivirus · fa0c05b6-8ad3-468d-8231-c1cbccb64fba

Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Techniques: T1204

T1204.002 Malicious File

KEV CVEs mapped to this technique · CTID Mappings Explorer

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1204.002

Rules tagged at the parent level (attack.t1204) 10

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1204.002`