User Execution T1204

Events covered

32 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 270 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (177 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Top indicator values (1672 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Exclusions (350 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 58 rules

• Antivirus Hacktool Detection
• AppLocker Prevented Application or Script from Running
• Arbitrary Shell Command Execution Via Settingcontent-Ms
• CLR DLL Loaded Via Office Applications
• DarkSide Ransomware Pattern
• DotNET Assembly DLL Loaded Via Office Application
• Download From Suspicious TLD - Blacklist
• Download From Suspicious TLD - Whitelist
• Droppers Exploiting CVE-2017-11882
• Edge abuse for payload download via console
• Edge/Chrome headless feature abuse for payload download
• Exploit for CVE-2017-0261
• Exploit for CVE-2017-8759
• File With Uncommon Extension Created By An Office Application
• FileFix - Command Evidence in TypedPaths
• Flash Player Update from Suspicious Location
• GAC DLL Loaded Via Office Applications
• HackTool - LittleCorporal Generated Maldoc Injection
• Kapeka Backdoor Loaded Via Rundll32.EXE
• macOS Gatekeeper User Override
• macOS XProtect Malware Detection
• Microsoft Excel Add-In Loaded
• Microsoft Excel Add-In Loaded From Uncommon Location
• Microsoft VBA For Outlook Addin Loaded Via Outlook
• Microsoft Word Add-In Loaded
• MMC Executing Files with Reversed Extensions Using RTLO Abuse
• New Application in AppCompat
• Payload Decoded and Decrypted via Built-in Utilities
• Potential ClickFix Execution Pattern - Registry
• Potential Maze Ransomware Activity
• Potential Snatch Ransomware Activity
• Potential Suspicious Browser Launch From Document Reader Process
• Potentially Suspicious WebDAV LNK Execution
• PrinterNightmare Mimikatz Driver Name
• Remote DLL Load Via Rundll32.EXE
• Successful MSIX/AppX Package Installation
• Suspicious Binaries and Scripts in Public Folder
• Suspicious Binary In User Directory Spawned From Office Application
• Suspicious ClickFix/FileFix Execution Pattern
• Suspicious Deno File Written from Remote Source
• Suspicious Execution via macOS Script Editor
• Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix
• Suspicious FileFix Execution Pattern
• Suspicious LNK Command-Line Padding with Whitespace Characters
• Suspicious Microsoft Office Child Process
• Suspicious Microsoft Office Child Process - MacOS
• Suspicious Outlook Child Process
• Suspicious Space Characters in RunMRU Registry Path - ClickFix
• Suspicious Space Characters in TypedPaths Registry Path - FileFix
• Suspicious Startup Folder Persistence
• Suspicious WMIC Execution Via Office Process
• Suspicious WmiPrvSE Child Process
• Symlink Etc Passwd
• Ursnif Malware C2 URL Pattern
• VBA DLL Loaded Via Office Application
• Windows AppX Deployment Full Trust Package Installation
• Windows AppX Deployment Unsigned Package Installation
• Windows MSIX Package Support Framework AI_STUBS Execution

Elastic 55 rules

• Anomalous Process For a Windows Population
• Anomalous Windows Process Creation
• Base64 Decoded Payload Piped to Interpreter
• Creation of SettingContent-ms Files
• Decoded Payload Piped to Interpreter Detected via Defend for Containers
• Downloaded Shortcut Files
• Downloaded URL Files
• Elastic Defend Alert Followed by Telemetry Loss
• Encoded Payload Detected via Defend for Containers
• Executable File Creation with Multiple Extensions
• Executable File Download via Wget
• Execution of a Downloaded Windows Script
• Execution of File Written or Modified by Microsoft Office
• File with Right-to-Left Override Character (RTLO) Created/Executed
• File with Suspicious Extension Downloaded
• Gatekeeper Override and Execution
• Google Workspace Object Copied to External Drive with App Consent
• Ingress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers
• M365 AIR Investigation Signal
• M365 Threat Intelligence Signal
• Malicious File - Detected - Elastic Defend
• Malicious File - Prevented - Elastic Defend
• Masquerading Space After Filename
• Microsoft Build Engine Started by an Office Application
• Microsoft Management Console File from Unusual Path
• MS Office Macro Security Registry Modifications
• Multi-Base64 Decoding Attempt from Suspicious Location
• Network Connection via Compiled HTML File
• Network Traffic to Rare Destination Country
• Node.js Pre or Post-Install Script Execution
• Potential Execution via FileFix Phishing Attack
• Potential Fake CAPTCHA Phishing Attack
• Potential Hex Payload Execution via Command-Line
• Potential Hex Payload Execution via Common Utility
• Potential Masquerading as Business App Installer
• Potential Notepad Markdown RCE Exploitation
• Potential Widespread Malware Infection Across Multiple Hosts
• Process Activity via Compiled HTML File
• Remote Desktop File Opened from Suspicious Path
• Spike in host-based traffic
• Suspicious Apple Mail Rule Plist Modification
• Suspicious Execution from a Mounted Device
• Suspicious Execution from a WebDav Share
• Suspicious Execution from INET Cache
• Suspicious Execution from VS Code Extension
• Suspicious Execution via Microsoft Office Add-Ins
• Suspicious HTML File Creation
• Suspicious macOS MS Office Child Process
• Suspicious MS Outlook Child Process
• Suspicious PDF Reader Child Process
• Suspicious Troubleshooting Pack Cabinet Execution
• Unusual Base64 Encoding/Decoding Activity
• Unusual Execution via Microsoft Common Console File
• Unusual Windows Path Activity
• Windows Script Execution from Archive

Splunk 98 rules

• 3CXDesktopApp.exe Execution (EDR)
• 3CXDesktopApp.exe Execution (Sysmon)
• 3CXDesktopApp.exe Execution (Windows Event Log)
• ASL AWS ECR Container Upload Outside Business Hours
• ASL AWS ECR Container Upload Unknown User
• AWS ECR Container Scanning Findings High
• AWS ECR Container Scanning Findings Low Informational Unknown
• AWS ECR Container Scanning Findings Medium
• AWS ECR Container Upload Outside Business Hours
• AWS ECR Container Upload Unknown User
• AWS Lambda UpdateFunctionCode
• Batch File Write to System32
• Cisco Isovalent - Non Allowlisted Image Use
• Cisco Isovalent - Pods Running Offensive Tools
• Cisco NVM - Susp Script From Archive Triggering Network Activity
• Cisco Secure Firewall - Lumma Stealer Activity
• Clop Common Exec Parameter
• Command Line Spawned by Archive Utility - Windows (Sysmon)
• Command Line Spawned by Archive Utility - Windows (Windows Event Log)
• Conti Common Exec parameter
• CVE-2022-30190: Microsoft Office Code Execution Vulnerability (EDR)
• CVE-2022-30190: Microsoft Office Code Execution Vulnerability (Sysmon)
• CVE-2022-30190: Microsoft Office Code Execution Vulnerability (Windows Event Log)
• Detect Rare Executables
• Drop IcedID License dat
• Executable Process from Suspicious Folder (PowerShell)
• Executable Process from Suspicious Folder (Sysmon)
• Executable Process from Suspicious Folder (Windows Event Log)
• Explorer Child Process with Suspicious Command Line Padding (Sysmon)
• ISO File in Temp Folder (Windows Event Log)
• ISO Image Mounted - Windows (PowerShell)
• ISO Image Mounted - Windows (Windows Event Log)
• Kubernetes Anomalous Inbound Network Activity from Process
• Kubernetes Anomalous Inbound Outbound Network IO
• Kubernetes Anomalous Inbound to Outbound Network IO Ratio
• Kubernetes Anomalous Outbound Network Activity from Process
• Kubernetes Anomalous Traffic on Network Edge
• Kubernetes Create or Update Privileged Pod
• Kubernetes DaemonSet Deployed
• Kubernetes Falco Shell Spawned
• Kubernetes newly seen TCP edge
• Kubernetes newly seen UDP edge
• Kubernetes Node Port Creation
• Kubernetes Pod Created in Default Namespace
• Kubernetes Pod With Host Network Attachment
• Kubernetes Previously Unseen Container Image Name
• Kubernetes Previously Unseen Process
• Kubernetes Process Running From New Path
• Kubernetes Process with Anomalous Resource Utilisation
• Kubernetes Process with Resource Ratio Anomalies
• Kubernetes Shell Running on Worker Node
• Kubernetes Shell Running on Worker Node with CPU Activity
• Kubernetes Unauthorized Access
• Malicious Document Execution (Sysmon)
• Malicious Document Execution (Windows Event Log)
• Microsoft Diagnostic Tool "DogWalk" Package Path Traversal (EDR)
• Microsoft Diagnostic Tool "DogWalk" Package Path Traversal (Sysmon)
• Microsoft Diagnostic Tool "DogWalk" Package Path Traversal (Windows Event Log)
• O365 SharePoint Malware Detection
• O365 Threat Intelligence Suspicious File Detected
• Office Spawns Suspicious Child Process (Sysmon)
• Office Spawns Suspicious Child Process (Windows Event Log)
• Potential CVE-2024-21413: Outbound SMB from Outlook (Sysmon)
• Potential CVE-2024-21413: Outbound SMB from Outlook (Windows Event Log)
• Process Executed from Downloads Folder - Windows (Sysmon)
• Process Executed from Downloads Folder - Windows (Windows Event Log)
• Rare executable from Microsoft Office (Sysmon)
• Rare executable from Microsoft Office (Windows Event Log)
• Rare Process Execution (Sysmon)
• Rare Process Execution (Windows Event Log)
• Revil Common Exec Parameter
• Risk Rule for Dev Sec Ops by Repository
• Single Letter Process On Endpoint
• Suspicious Process Executed From Container File
• Symbolic OR Hard File Link Created (PowerShell)
• Symbolic OR Hard File Link Created (Windows Event Log)
• WebDAV LNK Execution (Sysmon)
• WebDAV LNK Execution (Windows Event Log)
• Windows Advanced Installer MSIX with AI_STUBS Execution
• Windows AppX Deployment Full Trust Package Installation
• Windows AppX Deployment Package Installation Success
• Windows AppX Deployment Unsigned Package Installation
• Windows Binary Execution from an Archive
• Windows Default Cobalt Strike PowerShell Beacon
• Windows Developer-Signed MSIX Package Installation
• Windows EFI Volume Mount Attempt Via Mountvol
• Windows Explorer LNK Exploit Process Launch With Padding
• Windows Explorer.exe Spawning PowerShell or Cmd
• Windows ISO LNK File Creation
• Windows MSIX Package Interaction
• Windows Mustang Panda USB Tool Execution
• Windows NorthStar C2 Agent Execution
• Windows PowerShell FakeCAPTCHA Clipboard Execution
• Windows PowerShell Script From WindowsApps Directory
• Windows Suspect Process With Authentication Traffic
• Windows Suspicious QEMU Execution
• Windows Universal Data Link File Creation
• Windows User Execution Malicious URL Shortcut File

Kusto 42 rules

• Acronis - Multiple Endpoints Accessing Malicious URLs
• Audit policy manipulation using auditpol utility
• AWSCloudTrail - Successful API executed from a Tor exit node
• Cisco SE - Dropper activity on host
• Cisco SE - Generic IOC
• Cisco SE - Malware execusion on host
• Cisco SE High Events Last Hour
• Critical Severity Detection
• CyberArkEPM - Attack attempt not blocked
• CyberArkEPM - Multiple attack types
• CyberArkEPM - Possible execution of Powershell Empire
• CyberArkEPM - Process started from different locations
• CyberArkEPM - Renamed Windows binary
• CyberArkEPM - Uncommon process Internet access
• CyberArkEPM - Uncommon Windows process started from System folder
• CyberArkEPM - Unexpected executable extension
• CyberArkEPM - Unexpected executable location
• Dataverse - Malware found in SharePoint document management site
• Dataverse - TI map URL to DataverseActivity
• Detect .NET runtime being loaded in JScript for code execution
• Detect Malicious Teams Message
• Egress Defend - Dangerous Attachment Detected
• Egress Defend - Dangerous Link Click
• High severity malicious activity detected
• Insider Risk_High User Security Alert Correlations
• Insider Risk_High User Security Incidents Correlation
• Insider Risk_Microsoft Purview Insider Risk Management Alert Observed
• Insider Risk_Risky User Access By Application
• KnowBe4 Defend - Dangerous Attachment Detected
• KnowBe4 Defend - Dangerous Link Click
• Known Malware Detected
• Malware Detected
• Medium severity malicious activity detected
• Microsoft COVID-19 file hash indicator matches
• Netskope - WebTransaction Error Detection
• Network endpoint to host executable correlation
• SonicWall - Capture ATP Malicious File Detection
• Suspicious office child process created
• Suspicious Process Injection from Office application
• Threats detected by ESET
• Threats detected by Eset
• VTI - High Severity SHA1 Collision Detection

YARA-L 5 rules

• AWS GuardDuty Malicious Or Suspicious File Executed
• AWS Successful API From Tor Exit Node
• GCP Successful API Call From Tor Exit Node
• Google Workspace Malicious File Downloaded
• High Risk User Download Executable From Macro

Panther 12 rules

• AppOmni Alert Passthrough
• AWS command executed on the command line
• AWS EC2 Image Monitoring
• Gsuite Attachments Downloaded from Spam Email
• Gsuite Link Clicked in Spam Email
• Malicious Content Detected
• Malware Detected in Email
• Proofpoint Active Threat Campaign Detected
• Proofpoint Malware Detected
• Proofpoint Multiple Threats Detected
• Proofpoint Virus Detected
• Slack Potentially Malicious File Shared