1200KM / tag
attack.t1202 — sigma-tag tag
39 related reference pages for sigma-tag: attack.t1202.
Meaning and evidence boundary
Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.
Related pages
- Custom File Open Handler Executes PowerShell · sigma-rule
- Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE · sigma-rule
- Findstr Launching .lnk File · sigma-rule
- Indirect Command Execution From Script File Via Bash.EXE · sigma-rule
- Indirect Command Execution via SFTP ProxyCommand · sigma-rule
- Indirect Inline Command Execution Via Bash.EXE · sigma-rule
- Outlook EnableUnsafeClientMailRules Setting Enabled · sigma-rule
- Potential Arbitrary Command Execution Using Msdt.EXE · sigma-rule
- Potential Arbitrary Command Execution Via FTP.EXE · sigma-rule
- Potential Arbitrary DLL Load Using Winword · sigma-rule
- Potential Arbitrary File Download Using Office Application · sigma-rule
- Potential Arbitrary File Download Via Cmdl32.EXE · sigma-rule
- Potential Binary Impersonating Sysinternals Tools · sigma-rule
- Potentially Suspicious Child Process Of VsCode · sigma-rule
- Potentially Suspicious Child Processes Spawned by ConHost · sigma-rule
- Potentially Suspicious Office Document Executed From Trusted Location · sigma-rule
- Proxy Execution via Vshadow · sigma-rule
- Renamed CURL.EXE Execution · sigma-rule
- Renamed FTP.EXE Execution · sigma-rule
- Renamed NirCmd.EXE Execution · sigma-rule
- Renamed PAExec Execution · sigma-rule
- Renamed PingCastle Binary Execution · sigma-rule
- Renamed ZOHO Dctask64 Execution · sigma-rule
- Rundll32 Execution Without CommandLine Parameters · sigma-rule
- Suspicious Cabinet File Execution Via Msdt.EXE · sigma-rule
- Suspicious Child Process Of BgInfo.EXE · sigma-rule
- Suspicious High IntegrityLevel Conhost Legacy Option · sigma-rule
- Suspicious Remote Child Process From Outlook · sigma-rule
- Suspicious Runscripthelper.exe · sigma-rule
- Suspicious Service Binary Directory · sigma-rule
- Suspicious Splwow64 Without Params · sigma-rule
- Suspicious ZipExec Execution · sigma-rule
- Troubleshooting Pack Cmdlet Execution · sigma-rule
- Uncommon Child Process Of BgInfo.EXE · sigma-rule
- Uncommon Child Process Of Conhost.EXE · sigma-rule
- Uncommon Child Process Of Setres.EXE · sigma-rule
- Windows Binary Executed From WSL · sigma-rule
- WSL Child Process Anomaly · sigma-rule
- WSL Kali-Linux Usage · sigma-rule
Connected ecosystem references
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.