Malicious File
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001). Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.(C...
BY SOURCE
PROCEDURES (116)
Auto-extracted: 67 detections for authentication monitoring
Auto-extracted: 36 detections for general monitoring
Auto-extracted: 20 detections for attachment
Auto-extracted: 19 detections for script execution monitoring
Auto-extracted: 17 detections for email security
Auto-extracted: 10 detections for network connection monitoring
Auto-extracted: 8 detections for phish
Auto-extracted: 7 detections for email
Auto-extracted: 7 detections for macro
Auto-extracted: 7 detections for suspicious
Auto-extracted: 6 detections for service
Auto-extracted: 6 detections for email
Auto-extracted: 5 detections for base64
Auto-extracted: 5 detections for suspicious
Auto-extracted: 5 detections for download
Auto-extracted: 5 detections for encrypt
Auto-extracted: 4 detections for impersonat
Auto-extracted: 4 detections for office
Auto-extracted: 4 detections for download
Auto-extracted: 3 detections for http
Auto-extracted: 3 detections for phish
Auto-extracted: 3 detections for process creation monitoring
Auto-extracted: 3 detections for unusual
Auto-extracted: 3 detections for child process
Auto-extracted: 3 detections for bypass
Auto-extracted: 3 detections for office
Auto-extracted: 3 detections for suspicious
Auto-extracted: 3 detections for obfuscat
Auto-extracted: 3 detections for attachment
Auto-extracted: 3 detections for suspicious
Auto-extracted: 3 detections for credential
Auto-extracted: 3 detections for office
Auto-extracted: 3 detections for service
Auto-extracted: 3 detections for remote
Auto-extracted: 3 detections for encrypt
Auto-extracted: 3 detections for download
Auto-extracted: 2 detections for bypass
Auto-extracted: 2 detections for encrypt
Auto-extracted: 2 detections for phish
Auto-extracted: 2 detections for base64
Auto-extracted: 2 detections for impersonat
Auto-extracted: 2 detections for office
Auto-extracted: 2 detections for child process
Auto-extracted: 2 detections for event log
Auto-extracted: 2 detections for unusual
Auto-extracted: 2 detections for credential
Auto-extracted: 2 detections for macro
Auto-extracted: 2 detections for macro
Auto-extracted: 2 detections for base64
Auto-extracted: 2 detections for impersonat
Auto-extracted: 2 detections for masquerad
Auto-extracted: 2 detections for api
Auto-extracted: 2 detections for obfuscat
Auto-extracted: 2 detections for download
Auto-extracted: 2 detections for credential
Auto-extracted: 2 detections for obfuscat
Auto-extracted: 2 detections for wmi
Auto-extracted: 2 detections for service
Auto-extracted: 2 detections for module load monitoring
Auto-extracted: 2 detections for powershell
Auto-extracted: 1 detections for parent process
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for phish
Auto-extracted: 1 detections for attachment
Auto-extracted: 1 detections for attachment
Auto-extracted: 1 detections for cloud
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for attachment
Auto-extracted: 1 detections for dns
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for dns
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for office
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for email
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for base64
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for registry monitoring
Auto-extracted: 1 detections for email
Auto-extracted: 1 detections for obfuscat
Auto-extracted: 1 detections for masquerad
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for ransomware
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for ransomware
Auto-extracted: 1 detections for startup
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for parent process
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for cloud
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for startup
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for macro
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for bypass