Initial Access Detection Rules | Fibratus

Detection rules for Initial Access (MITRE ATT&CK): Office macro execution, HTML smuggling, ClickFix, and SMB-transferred payloads.

Back to all rules

Rules in this category

• Clickfix phishing via browser dialog box
• Executable file creation from a macro-enabled Microsoft Office document
• Execution via Microsoft Office process
• Macro execution via script interpreter
• Microsoft Office file execution via script interpreter
• Microsoft Office file execution via WMI
• Potential ClickFix infection chain
• Process spawned from macro-enabled Microsoft Office document
• Suspicious DLL loaded by Microsoft Office process
• Suspicious execution via WMI from a Microsoft Office process
• Suspicious file delivery via HTML smuggling
• Suspicious Microsoft Office embedded object