Tool

github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f

https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f

Published on: github.com

ATT&CK techniques those detections carry

T1566Phishing
T1218System Binary Proxy Execution
T1566.001Spearphishing Attachment
T1047Windows Management Instrumentation
T1059Command and Scripting Interpreter
T1059.001PowerShell
T1059.003Windows Command Shell
T1059.005Visual Basic
+13 more

11 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
Detection	Severity	Source	Published	Licence
Suspicious Microsoft OneNote Child Process	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Suspicious Cabinet File Execution Via Msdt.EXE	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Suspicious HH.EXE Execution	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
HTML Help HH.EXE Suspicious Child Process	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Suspicious DLL Loaded via CertOC.EXE	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
DLL Loaded via CertOC.EXE	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Potential Initial Access via DLL Search Order Hijacking	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Potential XCSSET Malware Infection	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Potential WizardUpdate Malware Infection	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Suspicious Execution via macOS Script Editor	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Payload Decoded and Decrypted via Built-in Utilities	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1

Showing 11 of 11

Filter in the catalogue