MITRE ATT&CK T1566 Detection Rules | Fibratus

Fibratus detection rules mapped to MITRE ATT&CK technique T1566. Kernel-level, behavior-driven detection coverage.

Back to all rules

Rules in this category

• Clickfix phishing via browser dialog box
• Executable file creation from a macro-enabled Microsoft Office document
• Execution via Microsoft Office process
• Macro execution via script interpreter
• Microsoft Office file execution via script interpreter
• Microsoft Office file execution via WMI
• Potential ClickFix infection chain
• Process spawned from macro-enabled Microsoft Office document
• Suspicious DLL loaded by Microsoft Office process
• Suspicious execution via WMI from a Microsoft Office process
• Suspicious file delivery via HTML smuggling
• Suspicious Microsoft Office embedded object