MITRE ATT&CK T1566 Detection Rules | Fibratus

Reglas de detección de Fibratus mapeadas a la técnica T1566 de MITRE ATT&CK. Cobertura basada en comportamiento a nivel de kernel.

Volver a todas las reglas

Reglas en esta categoría

• Clickfix phishing via browser dialog box
• Executable file creation from a macro-enabled Microsoft Office document
• Execution via Microsoft Office process
• Macro execution via script interpreter
• Microsoft Office file execution via script interpreter
• Microsoft Office file execution via WMI
• Potential ClickFix infection chain
• Process spawned from macro-enabled Microsoft Office document
• Suspicious DLL loaded by Microsoft Office process
• Suspicious execution via WMI from a Microsoft Office process
• Suspicious file delivery via HTML smuggling
• Suspicious Microsoft Office embedded object