T1204.002 Malicious File — Detection Rules

Source-backed rule directory

• Suspicious Microsoft Office Child Process - MacOS · test · high · {"product":"macos","category":"process_creation"}
• Download From Suspicious TLD - Blacklist · test · low · {"category":"proxy"}
• Download From Suspicious TLD - Whitelist · test · low · {"category":"proxy"}
• Flash Player Update from Suspicious Location · test · high · {"category":"proxy"}
• AppLocker Prevented Application or Script from Running · test · medium · {"product":"windows","service":"applocker"}
• Windows AppX Deployment Full Trust Package Installation · experimental · medium · {"product":"windows","service":"appxdeployment-server"}
• Windows AppX Deployment Unsigned Package Installation · experimental · medium · {"product":"windows","service":"appxdeployment-server"}
• File With Uncommon Extension Created By An Office Application · test · high · {"product":"windows","category":"file_event"}
• Suspicious Startup Folder Persistence · test · high · {"product":"windows","category":"file_event"}
• DotNET Assembly DLL Loaded Via Office Application · test · medium · {"category":"image_load","product":"windows"}
• CLR DLL Loaded Via Office Applications · test · medium · {"category":"image_load","product":"windows"}
• GAC DLL Loaded Via Office Applications · test · high · {"category":"image_load","product":"windows"}
• Microsoft Excel Add-In Loaded From Uncommon Location · test · medium · {"category":"image_load","product":"windows"}
• Microsoft VBA For Outlook Addin Loaded Via Outlook · test · medium · {"category":"image_load","product":"windows"}
• VBA DLL Loaded Via Office Application · test · high · {"category":"image_load","product":"windows"}
• Remote DLL Load Via Rundll32.EXE · test · medium · {"category":"image_load","product":"windows"}
• HackTool - LittleCorporal Generated Maldoc Injection · test · high · {"category":"process_access","product":"windows"}
• MMC Executing Files with Reversed Extensions Using RTLO Abuse · experimental · high · {"category":"process_creation","product":"windows"}
• Windows MSIX Package Support Framework AI_STUBS Execution · experimental · low · {"category":"process_creation","product":"windows"}
• Suspicious Outlook Child Process · test · high · {"category":"process_creation","product":"windows"}
• Suspicious Binary In User Directory Spawned From Office Application · test · high · {"category":"process_creation","product":"windows"}
• Suspicious Microsoft Office Child Process · test · high · {"category":"process_creation","product":"windows"}
• Potential Suspicious Browser Launch From Document Reader Process · test · medium · {"product":"windows","category":"process_creation"}
• Suspicious LNK Command-Line Padding with Whitespace Characters · experimental · high · {"category":"process_creation","product":"windows"}
• Suspicious WMIC Execution Via Office Process · test · high · {"product":"windows","category":"process_creation"}
• Suspicious WmiPrvSE Child Process · test · high · {"product":"windows","category":"process_creation"}
• New Application in AppCompat · test · informational · {"product":"windows","category":"registry_set"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0294 User Execution – Malicious File via download/open → spawn chain (T1204.002)

AN0819 Analytic 0819

User opens a file delivered by email, web, chat, or share. The handler application (Word/PDF reader/archiver) creates a file in user-controlled paths (Downloads, Temp, Desktop) and then spawns a new or unusual child process (e.g., powershell.exe, wscript.exe, cmd.exe, regsvr32.exe, rundll32.exe, msiexec.exe). Optional precursors include FileStreamCreated (URL/UNC) and Office → system32 batch writes.

AN0820 Analytic 0820

User opens a downloaded document/installer leading to EndpointSecurity file create in ~/Downloads or ~/Library paths then an exec of a suspicious utility (osascript, bash/zsh, curl, chmod, open with -a Terminal). Correlates File Creation with subsequent process exec and, optionally, quarantine/LSQuarantine events.

AN0821 Analytic 0821

User or desktop application writes a new file to ~/Downloads, /tmp, or mounted removable media followed by execve of a risky interpreter/loader (bash, sh, python, perl, php, node, curl|wget piping to sh, ld.so, rdesktop, xdg-open - with unusual args). Uses auditd PATH+SYSCALL (open/creat/write/rename) with execve event linking.