Cross-source coverage

T1204.001 / ATT&CK

User Execution: Malicious Link

31 rules across 7 sources.

From MITRE ATT&CK 19.2

An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Link. Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via Exploitation for Client Execution. Links may also lead users to download files that require execution via Malicious File.

Tactics
Execution
Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:SecurityWinEventLog:SysmonNSM:Flowauditd:SYSCALLmacos:unifiedlogNSM:Connectionsfs:fsevents

How MITRE says to detect it DET0066

User Execution – Malicious Link (click → suspicious egress → download/write → follow-on activity)

Windows Analytic 0178

Behavioral chain: (1) a user-facing app (browser/Office/email client) launches a URL or handles a link, then (2) the same process lineage makes an outbound connection to an untrusted domain/IP, (3) a file is downloaded or unpacked to a user-writable location shortly after the click. Optional enrichment: subsequent child execution by LOLBINs.

  • WinEventLog:Security EventCode=4688
  • WinEventLog:Sysmon EventCode=3, 22
  • WinEventLog:Sysmon EventCode=11
  • NSM:Flow Suspicious URL patterns, uncommon TLDs, short-lived domains, URL shorteners; HTTP method GET/POST

Linux Analytic 0179

Behavioral chain: (1) browser/office/GUI mail client opens a URL, (2) outbound connection to untrusted domain, (3) a new file is saved in $HOME/Downloads, /tmp, or cache immediately after.

  • auditd:SYSCALL execve: Execs of chromium, google-chrome, firefox, libreoffice with http(s) in cmdline
  • auditd:SYSCALL open,creat,rename: Writes in $HOME/Downloads, /tmp, ~/.cache with exe/script/archive/office extensions
  • NSM:Flow Suspicious URL patterns, uncommon TLDs, URL shorteners

macOS Analytic 0180

Behavioral chain: (1) Safari/Chrome/Firefox/Office handles a URL; unified logs show open/click or LSQuarantine assignment, (2) outbound connection to untrusted domain, (3) a new file appears in ~/Downloads or /private/var/folders/* with quarantine flag.

  • macos:unifiedlog open URL|clicked link|LSQuarantineAttach
  • NSM:Connections New outbound connection from Safari/Chrome/Firefox/Word
  • fs:fsevents Create in /Users/*/Downloads or /private/var/folders/* with quarantine attribute

View on attack.mitre.org ↗

elastic/protections-artifacts

17 rules
Detection Severity Format
Command Shell Execution from Untrusted Origin Undefined Elastic TOML
Embedded Executable via Windows Shortcut File Undefined Elastic TOML
Potential ClickFix Attack via Base64 Decoded Payload Undefined Elastic TOML
Potential ClickFix Attack via Windows Terminal Undefined Elastic TOML
Potential Decoy Document via User Execution Undefined Elastic TOML
Potential Execution via LNK Stomping Undefined Elastic TOML
Potential Payload Download via Finger LOLBin Undefined Elastic TOML
Shell Execution via Windows Shortcut File Undefined Elastic TOML
Shortcut File Modification via Macro Enabled Document Undefined Elastic TOML
Suspicious Execution via Microsoft Common Console Undefined Elastic TOML

+ 7 more from elastic/protections-artifacts → showing the 10 highest-severity

SigmaHQ/sigma

4 rules
Detection Severity Format
Potential ClickFix Execution Pattern - Registry High Sigma
Suspicious ClickFix/FileFix Execution Pattern High Sigma
Symlink Etc Passwd High Sigma
Suspicious Execution via macOS Script Editor Medium Sigma

Wazuh Core Ruleset

3 rules
Detection Severity Format
MS Graph message: Indicators that the system is infected with malware have been detected. Critical Wazuh XML
MS Graph message: Malware has been detected in the environment. This is a true positive alert. Critical Wazuh XML
MS Graph message: Indicators that the system is potentially infected with malware have been detected. Check the system for signs of infection. High Wazuh XML

elastic/detection-rules

3 rules
Detection Severity Format
Google Workspace Object Copied from External Drive with App Consent High Elastic TOML
XDG-Open Command Execution Medium Elastic TOML
Network Traffic to Rare Destination Country Low Elastic TOML

splunk/security_content

2 rules
Detection Severity Format
Windows ISO LNK File Creation Undefined SPL
Windows PowerShell FakeCAPTCHA Clipboard Execution Undefined SPL

Bert-JanP/Hunting-Queries-Detection-Rules

1 rule
Detection Severity Format
Malicious PowerShell Executions From Clipboard Copy-and-Paste Undefined KQL

panther-labs/panther-analysis

1 rule
Detection Severity Format
Gsuite Link Clicked in Spam Email High Panther Python

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.