Rule Document 1:301162

Rule Groups

MITRE::ATT&CK Framework::Enterprise::Execution::User Execution::Malicious File

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl.

T1204.002

Rule Categories::Operating Systems::Windows

Rules for detecting attacks against the Windows operating system

Rule Categories::Policy::Other

Rules for detecting miscellaneous traffic that may be against network policies

Vulnerability::Severity::Medium

Rules that cover vulnerabilities that have CVSS scores of 4.0-6.9.

Vulnerability::Severity::Critical

Rules that cover vulnerabilities that have CVSS scores of 10 (CVSS V2.0) or 9.0-10.0 (CVSS V3.0 ).

Vulnerability::Severity::High

Rules that cover vulnerabilities that have CVSS scores of 7.0-9.9 (CVSS V2.0) or 7.0-8.9 (CVSS V3.0 ).