T1203 Exploitation for Client Execution — Detection Rules

Source-backed rule directory

• Antivirus Exploitation Framework Detection · stable · critical · {"category":"antivirus"}
• Suspicious Download and Execute Pattern via Curl/Wget · experimental · high · {"category":"process_creation","product":"linux"}
• OMIGOD SCX RunAsProvider ExecuteScript · test · high · {"product":"linux","category":"process_creation"}
• OMIGOD SCX RunAsProvider ExecuteShellCommand · test · high · {"product":"linux","category":"process_creation"}
• Suspicious Invocation of Shell via Rsync · experimental · high · {"category":"process_creation","product":"linux"}
• Suspicious Browser Child Process - MacOS · test · medium · {"category":"process_creation","product":"macos"}
• Download From Suspicious TLD - Blacklist · test · low · {"category":"proxy"}
• Download From Suspicious TLD - Whitelist · test · low · {"category":"proxy"}
• Audit CVE Event · test · critical · {"product":"windows","service":"application"}
• Network Connection Initiated By Eqnedt32.EXE · test · high · {"category":"network_connection","product":"windows"}
• Office Application Initiated Network Connection To Non-Local IP · test · medium · {"category":"network_connection","product":"windows"}
• Suspicious ArcSOC.exe Child Process · experimental · high · {"category":"process_creation","product":"windows"}
• Suspicious HWP Sub Processes · test · high · {"category":"process_creation","product":"windows"}
• Java Running with Remote Debugging · test · medium · {"category":"process_creation","product":"windows"}
• Potentially Suspicious Child Process of KeyScrambler.exe · test · medium · {"category":"process_creation","product":"windows"}
• Suspicious Spool Service Child Process · test · high · {"category":"process_creation","product":"windows"}
• Potentially Suspicious Child Process Of WinRAR.EXE · test · medium · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

T1203 Exploitation for Client Execution

MATCH(exploit_mitigation_block OR application_crash_signature) FOLLOWED_BY child_process_creation WITHIN 2m -> ALERT

• Memory-Protection and Exploit-Mitigation Logs
• Operating-System Crash and Diagnostic Logs
• Process Execution Logs
• Atlas source section

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0287 Exploitation for Client Execution – cross-platform behavior chain (browser/Office/3rd-party apps)

AN0797 Analytic 0797

Cause→effect chain: (1) A client app (browser, Office, PDF/Flash/reader) experiences a crash/abnormal exit or loads from an unusual location, then (2) drops or modifies a file in user-writable paths, and/or (3) spawns an unexpected child (e.g., powershell/cmd/mshta/rundll32/wscript/installer), and (4) establishes outbound C2-like connections shortly after. Correlate application logs, file writes, process lineage, and network egress within a short window.

AN0798 Analytic 0798

Cause→effect chain: (1) Browser/Office/reader process logs crash/segfault or abnormal sandbox message, (2) new executable/script/write occurs in $HOME (Downloads, ~/.cache, /tmp), (3) unexpected child like curl/wget/bash/python opens network connections soon after.

AN0799 Analytic 0799

Cause→effect chain: (1) App crash/abnormal termination in unified logs for Safari/Chrome/Office/Preview, (2) new files/scripts in ~/Library, ~/Downloads, /private/var/folders/*, (3) unexpected child (osascript, zsh, bash, curl) spawned by those apps, (4) new outbound connections.