Rule Document 1:301312

Rule Groups

MITRE::ATT&CK Framework::Enterprise::Execution::User Execution::Malicious File

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl.

T1204.002

Rule Categories::Operating Systems::Windows

Rules for detecting attacks against the Windows operating system

MITRE::ATT&CK Framework::Enterprise::Privilege Escalation::Exploitation for Privilege Escalation

Privilege escalation includes techniques that allow an attacker to obtain a higher level of permissions on the mobile device. Attackers may enter the mobile device with very limited privileges and may be required to take advantage of a device weakness to obtain higher privileges necessary to successfully carry out their mission objectives.

T1068

Vulnerability::Severity::Critical

Rules that cover vulnerabilities that have CVSS scores of 10 (CVSS V2.0) or 9.0-10.0 (CVSS V3.0 ).

Vulnerability::Severity::High

Rules that cover vulnerabilities that have CVSS scores of 7.0-9.9 (CVSS V2.0) or 7.0-8.9 (CVSS V3.0 ).

Vulnerability::Severity::Medium

Rules that cover vulnerabilities that have CVSS scores of 4.0-6.9.