Acceso inicial Detection Rules | Fibratus

Reglas de detección para Acceso inicial (MITRE ATT&CK): ejecución de macros de Office, HTML smuggling, ClickFix y payloads transferidos por SMB.

Volver a todas las reglas

Reglas en esta categoría

• Clickfix phishing via browser dialog box
• Executable file creation from a macro-enabled Microsoft Office document
• Execution via Microsoft Office process
• Macro execution via script interpreter
• Microsoft Office file execution via script interpreter
• Microsoft Office file execution via WMI
• Potential ClickFix infection chain
• Process spawned from macro-enabled Microsoft Office document
• Suspicious DLL loaded by Microsoft Office process
• Suspicious execution via WMI from a Microsoft Office process
• Suspicious file delivery via HTML smuggling
• Suspicious Microsoft Office embedded object