MITRE ATT&CK T1204 Detection Rules | Fibratus

Fibratus detection rules mapped to MITRE ATT&CK technique T1204. Kernel-level, behavior-driven detection coverage.

Back to all rules

Rules in this category

• Embedded executable file run via shortcut
• Embedded script execution via shortcut file
• Process execution from compressed file via Explorer
• Suspicious MSHTA execution via HTML smuggling
• Suspicious process execution from archive via shortcut file