Suspicious Microsoft Office embedded object

Identifies Microsoft Office processes dropping a file with suspicious extension and with the call stack indicating operations to save or load the file from an embedded OLE object.

• Platform: Windows
• Severity: High
• MITRE Tactic: Initial Access
• MITRE Techniques: T1566, T1566.001

Back to all rules