Cross-source coverage

T1204.002 / ATT&CK

User Execution: Malicious File

178 rules · 175 families across 11 sources.

2 atomic-IOC hidden · include

From MITRE ATT&CK 19.2

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including.doc,.pdf,.xls,.rtf,.scr,.exe,.lnk,.pif,.cpl,.reg, and.iso.

Adversaries may employ various forms of Masquerading and Obfuscated Files or Information to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it.

While Malicious File frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing.

Tactics
Execution
Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:Sysmonmacos:unifiedlogmacos:endpointsecurityauditd:SYSCALL

How MITRE says to detect it DET0294

User Execution – Malicious File via download/open → spawn chain (T1204.002)

Windows Analytic 0819

User opens a file delivered by email, web, chat, or share. The handler application (Word/PDF reader/archiver) creates a file in user-controlled paths (Downloads, Temp, Desktop) and then spawns a new or unusual child process (e.g., powershell.exe, wscript.exe, cmd.exe, regsvr32.exe, rundll32.exe, msiexec.exe). Optional precursors include FileStreamCreated (URL/UNC) and Office → system32 batch writes.

  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Sysmon EventCode=15

macOS Analytic 0820

User opens a downloaded document/installer leading to EndpointSecurity file create in ~/Downloads or ~/Library paths then an exec of a suspicious utility (osascript, bash/zsh, curl, chmod, open with -a Terminal). Correlates File Creation with subsequent process exec and, optionally, quarantine/LSQuarantine events.

  • macos:unifiedlog process_exec: image in {/bin/bash,/bin/zsh,/usr/bin/osascript,/usr/bin/python*,/usr/bin/curl,/usr/bin/ssh,/usr/bin/open} AND parent in {Preview, TextEdit, Microsoft Word, Microsoft Excel, AdobeReader, Archive Utility, Finder}
  • macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_CREATE: path under /Users/*/(Downloads|Desktop|Library/*/Containers|Library/Group Containers) AND extension in SuspiciousExtensions

Linux Analytic 0821

User or desktop application writes a new file to ~/Downloads, /tmp, or mounted removable media followed by execve of a risky interpreter/loader (bash, sh, python, perl, php, node, curl|wget piping to sh, ld.so, rdesktop, xdg-open - with unusual args). Uses auditd PATH+SYSCALL (open/creat/write/rename) with execve event linking.

  • auditd:SYSCALL open/create/rename: name in (/home/*/Downloads/*|/tmp/*|/run/user/*|/media/*) AND ext in SuspiciousExtensions
  • auditd:SYSCALL execve: exe in {/bin/bash,/bin/sh,/usr/bin/python*,/usr/bin/perl,/usr/bin/php,/usr/bin/node,/usr/bin/curl,/usr/bin/wget,/usr/bin/xdg-open,/usr/bin/ssh,/usr/bin/rundll32 (wine)} AND ppid process is a document viewer/browser

View on attack.mitre.org ↗

elastic/detection-rules

47 rules
Detection Severity Format
Base64 Decoded Payload Piped to Interpreter High Elastic TOML
Decoded Payload Piped to Interpreter Detected via Defend for Containers High Elastic TOML
Elastic Defend Alert Followed by Telemetry Loss High Elastic TOML
Execution of File Written or Modified by Microsoft Office High Elastic TOML
Gatekeeper Override and Execution High Elastic TOML
Ingress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers High Elastic TOML
Microsoft Build Engine Started by an Office Application High Elastic TOML
Potential Execution via FileFix Phishing Attack High Elastic TOML
Potential Notepad Markdown RCE Exploitation High Elastic TOML
Potential Widespread Malware Infection Across Multiple Hosts High Elastic TOML

+ 37 more from elastic/detection-rules → showing the 10 highest-severity

elastic/protections-artifacts

41 rules
Detection Severity Format
Attempt to Mount a Remote WebDav Share Undefined Elastic TOML
Base64 or Xxd Decode Argument Evasion Undefined Elastic TOML
Base64 Shebang Payload Decoded via Built-in Utility Undefined Elastic TOML
Decoded or Decrypted Payload Written to Suspicious Directory Undefined Elastic TOML
Decoded Payload Piped to Interpreter Undefined Elastic TOML
Decoy Document Creation via Curl Undefined Elastic TOML
Decoy file Open via Preview App Undefined Elastic TOML
Disk Image Download and Mount via Hdiutil Undefined Elastic TOML
DLL Loaded from WebDav Share Undefined Elastic TOML
DNS Query to Suspicious Top Level Domain Undefined Elastic TOML

+ 31 more from elastic/protections-artifacts → showing the 10 highest-severity

SigmaHQ/sigma

37 rules
Detection Severity Format
Droppers Exploiting CVE-2017-11882 Critical Sigma
Exploit for CVE-2017-8759 Critical Sigma
Potential Maze Ransomware Activity Critical Sigma
File With Uncommon Extension Created By An Office Application High Sigma
GAC DLL Loaded Via Office Applications High Sigma
HackTool - LittleCorporal Generated Maldoc Injection High Sigma
Kapeka Backdoor Loaded Via Rundll32.EXE High Sigma
MMC Executing Files with Reversed Extensions Using RTLO Abuse High Sigma
Suspicious Binary In User Directory Spawned From Office Application High Sigma
Suspicious LNK Command-Line Padding with Whitespace Characters High Sigma

+ 27 more from SigmaHQ/sigma → showing the 10 highest-severity

splunk/security_content

26 rules
Detection Severity Format
Batch File Write to System32 Undefined SPL
Cisco NVM - Susp Script From Archive Triggering Network Activity Undefined SPL
Drop IcedID License dat Undefined SPL
Linux Ghostscript Exploitation Undefined SPL
O365 SharePoint Malware Detection Undefined SPL
O365 Threat Intelligence Suspicious File Detected Undefined SPL
Single Letter Process On Endpoint Undefined SPL
Suspicious Process Executed From Container File Undefined SPL
Windows Advanced Installer MSIX with AI_STUBS Execution Undefined SPL
Windows AppX Deployment Full Trust Package Installation Undefined SPL

+ 16 more from splunk/security_content → showing the 10 highest-severity

Wazuh Core Ruleset

6 rules
Detection Severity Format
Executed suspicious process with right to left override character in binary file, possible malicious file masquerading Critical Wazuh XML
MS Graph message: Indicators that the system is infected with malware have been detected. Critical Wazuh XML
MS Graph message: Malware has been detected in the environment. This is a true positive alert. Critical Wazuh XML
Cmd.exe executed from non-standard directory, may be related to link execution from mounted ISO file High Wazuh XML
MS Graph message: Indicators that the system is potentially infected with malware have been detected. Check the system for signs of infection. High Wazuh XML
Rundll32 executed from non-standard directory, may be related to link execution from mounted ISO file High Wazuh XML

chainguard-dev/osquery-defense-kit

6 rules · 5 families
Detection Severity Format
Look for sketchy mounted disk images, inspired by Shlayer 2 variants Undefined osquery SQL
Look for sketchy mounted disk images, inspired by Shlayer 2 variants Undefined osquery SQL
Scan removable volumes for sketchy files Undefined osquery SQL
Surface ISO/DMG disk images that were downloaded from unexpected places Undefined osquery SQL
Unexpected process that spawns shell processes (event based) Undefined osquery SQL
Unexpected process that spawns shell processes (event-based) Undefined osquery SQL

socfortress/Wazuh-Rules

5 rules
Detection Severity Format
Sysmon - Event 1: Process creation · Encoded PowerShell from Office (T1204.002) High Wazuh XML
Sysmon - Event 1: Process creation · Office launching cscript (T1204.002) High Wazuh XML
Sysmon - Event 1: Process creation · Office launching explorer (T1204.002) High Wazuh XML
Sysmon - Event 1: Process creation · Office launching headless Chrome (T1204.002) High Wazuh XML
Sysmon - Event 1: Process creation · Office launching mshta (T1204.002) High Wazuh XML

Bert-JanP/Hunting-Queries-Detection-Rules

3 rules
Detection Severity Format
File that contains malware detected by Defender For Cloud Apps Undefined KQL
Malware File Detected In Office 365 Undefined KQL
MITRE ATT&CK Mapping Undefined KQL

chronicle/detection-rules

3 rules
Detection Severity Format
aws_guardduty_malicious_or_suspicious_file_executed High YARA-L
high_risk_user_download_executable_from_macro High YARA-L
google_workspace_malicious_file_downloaded Medium YARA-L

panther-labs/panther-analysis

3 rules
Detection Severity Format
Slack Potentially Malicious File Shared Critical Panther Python
Gsuite Attachments Downloaded from Spam Email High Panther Python
Malware Detected in Email High Panther Python

Azure/Azure-Sentinel

1 rule
Detection Severity Format
Gentlemen Ransomware payload execution and staging Undefined KQL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.