T1204.001 Malicious Link — Detection Rules

Source-backed rule directory

• Symlink Etc Passwd · test · high · {"product":"linux"}
• Suspicious Execution via macOS Script Editor · test · medium · {"category":"process_creation","product":"macos"}
• Suspicious ClickFix/FileFix Execution Pattern · experimental · high · {"category":"process_creation","product":"windows"}
• Potential ClickFix Execution Pattern - Registry · experimental · high · {"category":"registry_set","product":"windows"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0066 User Execution – Malicious Link (click → suspicious egress → download/write → follow-on activity)

AN0178 Analytic 0178

Behavioral chain: (1) a user-facing app (browser/Office/email client) launches a URL or handles a link, then (2) the same process lineage makes an outbound connection to an untrusted domain/IP, (3) a file is downloaded or unpacked to a user-writable location shortly after the click. Optional enrichment: subsequent child execution by LOLBINs.

AN0179 Analytic 0179

Behavioral chain: (1) browser/office/GUI mail client opens a URL, (2) outbound connection to untrusted domain, (3) a new file is saved in $HOME/Downloads, /tmp, or cache immediately after.

AN0180 Analytic 0180

Behavioral chain: (1) Safari/Chrome/Firefox/Office handles a URL; unified logs show open/click or LSQuarantine assignment, (2) outbound connection to untrusted domain, (3) a new file appears in ~/Downloads or /private/var/folders/* with quarantine flag.