Execution Detection Rules | Fibratus

Detection rules for Execution (MITRE ATT&CK): LOLBin abuse, rundll32, mshta, WMI, and script interpreter execution.

Back to all rules

Rules in this category

• Embedded executable file run via shortcut
• Embedded script execution via shortcut file
• Process execution from compressed file via Explorer
• Suspicious MSHTA execution via HTML smuggling
• Suspicious process execution from archive via shortcut file