T1204.002 Malicious File

Who uses it · with stories on Jábega

• Callisto
• Sandworm
• DragonForce
• Earth Lusca

Sigma rules to hunt it

• Droppers Exploiting CVE-2017-11882criticalstable · windows
• Ursnif Malware C2 URL Patterncriticalstable · proxy
• Exploit for CVE-2017-8759criticaltest · windows
• Potential Maze Ransomware Activitycriticaltest · windows
• File With Uncommon Extension Created By An Office Applicationhightest · windows
• Flash Player Update from Suspicious Locationhightest · proxy
• GAC DLL Loaded Via Office Applicationshightest · windows
• HackTool - LittleCorporal Generated Maldoc Injectionhightest · windows
• Kapeka Backdoor Loaded Via Rundll32.EXEhightest · windows
• Suspicious Binary In User Directory Spawned From Office Applicationhightest · windows
• Suspicious Microsoft Office Child Processhightest · windows
• Suspicious Microsoft Office Child Process - MacOShightest · macos
• Suspicious Outlook Child Processhightest · windows
• Suspicious Startup Folder Persistencehightest · windows
• Suspicious WMIC Execution Via Office Processhightest · windows
• Suspicious WmiPrvSE Child Processhightest · windows
• VBA DLL Loaded Via Office Applicationhightest · windows
• MMC Executing Files with Reversed Extensions Using RTLO Abusehighexperimental · windows
• Suspicious LNK Command-Line Padding with Whitespace Charactershighexperimental · windows
• TanStack Supply-Chain Attack Execution Indicators - Linuxhighexperimental · linux
• TanStack Supply-Chain Attack Execution Indicators - Windowshighexperimental · windows
• AppLocker Prevented Application or Script from Runningmediumtest · windows
• CLR DLL Loaded Via Office Applicationsmediumtest · windows
• DotNET Assembly DLL Loaded Via Office Applicationmediumtest · windows
• Exploit for CVE-2017-0261mediumtest · windows

Showing 25 of 32.