Coverage › CVE-2025-33053

CVE-2025-33053 Mapped Sigma

Microsoft Windows External Control of File Name or Path Vulnerability

Vendor / product: Microsoft — Windows
Description (CISA): Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files.
Added to KEV: 2025-06-10
Due date: 2025-07-01
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Known ransomware use: Unknown
CWE: CWE-73
CISA notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053
https://nvd.nist.gov/vuln/detail/CVE-2025-33053
Elsewhere: cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

5 mapping objects across 5 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Technique	Mapping type	CTID comment	Status in v19.2
T1566.001 Spearphishing Attachment	exploitation technique	By manipulating the working directory of Windows processes, attackers can utilize these valid processes and trick them into running arbitrary code from a WebDAV server. This has been done by using a phishing email with a malicious PDF document attached, leading to code execution, the creation of backdoors, the introduction of a keylogger onto the system, and data exfiltration via C2. ref 1	live
T1041 Exfiltration Over C2 Channel	secondary impact	By manipulating the working directory of Windows processes, attackers can utilize these valid processes and trick them into running arbitrary code from a WebDAV server. This has been done by using a phishing email with a malicious PDF document attached, leading to code execution, the creation of backdoors, the introduction of a keylogger onto the system, and data exfiltration via C2. ref 1	live
T1056.001 Keylogging	secondary impact	By manipulating the working directory of Windows processes, attackers can utilize these valid processes and trick them into running arbitrary code from a WebDAV server. This has been done by using a phishing email with a malicious PDF document attached, leading to code execution, the creation of backdoors, the introduction of a keylogger onto the system, and data exfiltration via C2. ref 1	live
T1059 Command and Scripting Interpreter	primary impact	By manipulating the working directory of Windows processes, attackers can utilize these valid processes and trick them into running arbitrary code from a WebDAV server. This has been done by using a phishing email with a malicious PDF document attached, leading to code execution, the creation of backdoors, the introduction of a keylogger onto the system, and data exfiltration via C2. ref 1	live
T1543 Create or Modify System Process	secondary impact	By manipulating the working directory of Windows processes, attackers can utilize these valid processes and trick them into running arbitrary code from a WebDAV server. This has been done by using a phishing email with a malicious PDF document attached, leading to code execution, the creation of backdoors, the introduction of a keylogger onto the system, and data exfiltration via C2. ref 1	live

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1041 Exfiltration Over C2 Channel secondary impact

DET0348 Detection Strategy for Exfiltration Over C2 Channel
AN0988 Windows
Identifies suspicious outbound traffic volume mismatches from processes that typically do not generate network activity, particularly over C2 protocols like HTTPS, DNS, or custom TCP/UDP ports, following file or data access.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation
NSM:Flow Flow/PCAP analysis for outbound payloads → DC0085 Network Traffic Content
WinEventLog:Security EventCode=4663, 4670, 4656 → DC0055 File Access

Tunable: DataVolumeThreshold KnownBenignProcesses

AN0989 Linux
Monitors for processes reading sensitive files then immediately initiating unusual outbound connections or bulk transfer sessions over persistent sockets, particularly with encrypted or binary payloads.

auditd:SYSCALL execve → DC0032 Process Creation
auditd:SYSCALL connect → DC0082 Network Connection Creation
NSM:Flow conn.log + files.log + ssl.log → DC0085 Network Traffic Content
NSM:Flow session stats with bytes_out > bytes_in → DC0078 Network Traffic Flow

Tunable: OutboundEntropyScore ConnectionDuration

AN0990 macOS
Detects unauthorized applications or scripts accessing sensitive data followed by establishing encrypted outbound communication to rare external destinations or with abnormal byte ratios.

macos:unifiedlog eventMessage = 'open', 'sendto', 'connect' → DC0085 Network Traffic Content
macos:osquery socket_events → DC0078 Network Traffic Flow
macos:osquery process_events → DC0032 Process Creation

Tunable: ParentProcessAncestry ProtocolList

AN0991 ESXi
Detects VMs sending outbound traffic through non-standard services or to unknown destinations. Exfiltration over reverse shells tunneled via VMkernel or custom payloads routed via hostd/vpxa.

esxi:vpxa connection attempts and data transmission logs → DC0078 Network Traffic Flow
esxi:vmkernel network stack module logs → DC0085 Network Traffic Content
esxi:syslog guest OS outbound transfer logs → DC0055 File Access

Tunable: GuestOSAllowList TransferSizeThresholdMB ProtocolAllowList

Sigma rules tagged `attack.t1041` (5)

Network Communication Initiated To Portmap.IO Domain mediumtest

Author: Florian Roth (Nextron Systems) · 2024-05-31 · logsource: product=windows category=network_connection · 07837ab9-60e1-481f-a74d-c31fb496a94c

Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic or data exfiltration by malicious actors

Techniques: T1041 T1090.002

Equation Group C2 Communication hightest

Author: Florian Roth (Nextron Systems) · 2017-04-15 (modified 2021-11-27) · logsource: category=firewall · 881834a4-6659-4773-821e-1c151789d873

Detects communication to C2 servers mentioned in the operational notes of the ShadowBroker leak of EquationGroup C2 tools

Techniques: T1041

OpenCanary - TFTP Request hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · b4e6b016-a2ac-4759-ad85-8000b300d61e

Detects instances where a TFTP service on an OpenCanary node has had a request.

Techniques: T1041

Tunneling Tool Execution mediumtest

Author: Daniil Yugoslavskiy, oscd.community · 2019-10-24 (modified 2024-01-18) · logsource: product=windows category=process_creation · c75309a3-59f8-4a8d-9c2c-4c927ad50555

Detects the execution of well known tools that can be abused for data exfiltration and tunneling.

Techniques: T1041 T1572 T1071.001

Shai-Hulud NPM Package Malicious Exfiltration via Curl highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-09-24 · logsource: product=linux category=process_creation · efd2eb09-b72e-4a61-8dc7-b1382a1e8983

Detects potential Shai Hulud NPM package attack attempting to exfiltrate data via curl to external webhook sites.

Techniques: T1041 T1005

T1056.001 Keylogging secondary impact

DET0089 Behavioral Detection of Keylogging Activity Across Platforms
AN0243 Windows
Monitors suspicious usage of Windows API calls like SetWindowsHookEx, GetKeyState, or polling functions within non-UI service processes, combined with Registry or driver modifications.

WinEventLog:Sysmon EventCode=10 → DC0035 Process Access
WinEventLog:Security EventCode=4663, 4670, 4656 → DC0055 File Access
WinEventLog:System EventCode=7045 → DC0060 Service Creation
WinEventLog:Sysmon EventCode=13, 14 → DC0063 Windows Registry Key Modification

Tunable: TargetImage AccessMask TimeWindow

AN0244 Linux
Detects non-system processes accessing /dev/input/* or issuing ptrace/evdev syscalls used for reading keystroke buffers directly.

auditd:SYSCALL open, read → DC0055 File Access
auditd:SYSCALL ptrace, ioctl → DC0021 OS API Execution

Tunable: ProcessName DevicePath

AN0245 macOS
Detects unauthorized TCC access or use of Quartz Event Services (CGEventTapCreate) or IOHID for event tap installation within unexpected processes.

macos:unifiedlog subsystem=com.apple.TCC → DC0034 Process Metadata
macos:osquery process_events OR launchd → DC0032 Process Creation

Tunable: Service ExecutablePath

AN0246 Network Devices
Keylogging on legacy network devices via unauthorized system image modification or remote capture of console keystrokes (telnet, SSH) through altered firmware or man-in-the-middle key sniffing.

networkdevice:syslog Image Upgrade / Configuration Change → DC0004 Firmware Modification
NSM:Flow packet capture or DPI logs → DC0085 Network Traffic Content

Tunable: FirmwareVersion Protocol

Sigma rules tagged `attack.t1056.001` (3)

Powershell Keylogging mediumtest

Author: frack113 · 2021-07-30 (modified 2022-07-11) · logsource: product=windows category=ps_script · 34f90d3c-c297-49e9-b26d-911b05a4866c

Adversaries may log user keystrokes to intercept credentials as the user types them.

Techniques: T1056.001

Linux Keylogging with Pam.d hightest

Author: Pawel Mazur · 2021-05-24 (modified 2022-12-18) · logsource: product=linux service=auditd · 49aae26c-450e-448b-911d-b3c13d178dfc

Detect attempt to enable auditing of TTY input

Techniques: T1003 T1056.001

Potential Keylogger Activity mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-04 · logsource: product=windows category=ps_script · 965e2db9-eddb-4cf6-a986-7a967df651e4

Detects PowerShell scripts that contains reference to keystroke capturing functions

Techniques: T1056.001

T1059 Command and Scripting Interpreter primary impact

DET0516 Behavioral Detection of Command and Scripting Interpreter Abuse
AN1428 Windows
Detects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: CommandLinePattern ParentProcessName TimeWindow

AN1429 Linux
Detects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh.

auditd:SYSCALL execve → DC0032 Process Creation

Tunable: InterpreterName UserContext ExecutionChainLength

AN1430 macOS
Detects launch of command-line interpreters via Terminal, Automator, or hidden osascript, especially when parent process lineage deviates from user-initiated applications.

macos:unifiedlog log stream --info --predicate 'eventMessage CONTAINS "exec"' → DC0032 Process Creation

Tunable: LaunchAgentName ScriptName TerminalAppUsage

AN1431 ESXi
Detects use of 'esxcli system' or direct interpreter commands (e.g., busybox shell) invoked from SSH or host terminal unexpectedly.

esxi:vobd shell session start → DC0064 Command Execution

Tunable: ShellEnabledFlag SSHContext

AN1432 Network Devices
Identifies CLI interpreter access (e.g., Cisco IOS, Juniper JUNOS) via enable mode or scripting-capable sessions used by uncommon accounts or from unknown IPs.

networkdevice:cli shell command → DC0064 Command Execution
networkdevice:syslog authentication & authorization → DC0002 User Account Authentication

Tunable: UserRole DeviceType

Sigma rules tagged `attack.t1059` (95)

Suspicious Browser Child Process - MacOS mediumtest

Author: Sohan G (D4rkCiph3r) · 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6

Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.

Techniques: T1189 T1203 T1059

Add New Download Source To Winget mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-04-17 · logsource: product=windows category=process_creation · 05ebafc8-7aa2-4bcd-a269-2aec93f9e842

Detects usage of winget to add new additional download sources

Techniques: T1059

Potential Arbitrary Command Execution Via FTP.EXE mediumtest

Author: Victor Sergeev, oscd.community · 2020-10-09 (modified 2024-04-23) · logsource: product=windows category=process_creation · 06b401f4-107c-4ff9-947f-9ec1e7649f1e

Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".

Techniques: T1059 T1202

Use of Pcalua For Execution mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community · 2022-06-14 (modified 2023-01-04) · logsource: product=windows category=process_creation · 0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2

Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.

Techniques: T1059

Shai-Hulud Malware Indicators - Linux highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-25 · logsource: product=linux category=process_creation · 11bb9b26-4179-4a06-afcb-1ec31fce1627

Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.

Techniques: T1059

Script Interpreter Execution From Suspicious Folder hightest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2022-02-08 (modified 2026-02-17) · logsource: product=windows category=process_creation · 1228c958-e64e-4e71-92ad-7d429f4138ba

Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity. Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.

Techniques: T1059

DNS Request From Windows Script Host lowtest

Author: Josh Nickels, Marius Rothenbücher · 2024-09-06 · logsource: product=windows category=dns_query · 12310575-e8b1-475c-a976-57ed540b349c

Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.

Techniques: T1059

Windows Shell/Scripting Application File Write to Suspicious Folder hightest

Author: Florian Roth (Nextron Systems) · 2021-11-20 (modified 2023-03-29) · logsource: product=windows category=file_event · 1277f594-a7d1-4f28-a2d3-73af5cbeab43

Detects Windows shells and scripting applications that write files to suspicious folders

Techniques: T1059

Elevated System Shell Spawned From Uncommon Parent Location mediumtest

Author: frack113, Tim Shelton (update fp) · 2022-12-05 (modified 2025-03-06) · logsource: product=windows category=process_creation · 178e615d-e666-498b-9630-9ed363038101

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.

Techniques: T1059

DarkGate - Autoit3.EXE File Creation By Uncommon Process mediumtest

Author: Micah Babinski · 2023-10-15 · logsource: product=windows category=file_event · 1a433e1d-03d2-47a6-8063-ece992cf4e73

Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

Techniques: T1105 T1059

CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows) mediumtest

Author: Andreas Braathen (mnemonic.io) · 2023-11-14 · logsource: product=windows category=process_creation · 1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

Techniques: T1059 T1190

CVE tags: CVE-2023-22518

Ruby Inline Command Execution mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-02 · logsource: product=windows category=process_creation · 20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8

Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.

Techniques: T1059

Payload Decoded and Decrypted via Built-in Utilities mediumtest

Author: Tim Rauch (rule), Elastic (idea) · 2022-10-17 · logsource: product=macos category=process_creation · 234dc5df-40b5-49d1-bf53-0d44ce778eca

Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.

Techniques: T1059 T1204 T1140

Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-14 · logsource: product=windows category=process_creation · 236d8e89-ed95-4789-a982-36f4643738ba

Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state

Techniques: T1059

Renamed PingCastle Binary Execution hightest

Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) · 2024-01-11 · logsource: product=windows category=process_creation · 2433a154-bb3d-42e4-86c3-a26bdac91c45

Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.

Techniques: T1059 T1202

All 95 rules on the technique page →

T1543 Create or Modify System Process secondary impact

DET0571 Detection of System Process Creation or Modification Across Platforms
AN1575 Windows
Detects command-line or API-based creation/modification of Windows Services via sc.exe, powershell.exe, services.exe, or ChangeServiceConfig. Looks for creation/modification of autostart services via registry changes, file drops to System32\services, and anomalous parent-child process trees.

WinEventLog:Security EventCode=4697 → DC0060 Service Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=13, 14 → DC0063 Windows Registry Key Modification

Tunable: ServiceNamePattern ParentProcessFilter RegistryPathList

AN1576 Linux
Detects creation or modification of systemd service units, addition of cron jobs that invoke binaries on boot, or suspicious writes to /etc/init.d/. Monitors chmod +x and systemctl execution paths, especially from non-root parent processes.

auditd:SYSCALL write or rename to /etc/systemd/system or /etc/init.d → DC0061 File Modification
auditd:SYSCALL execution of systemctl or service with enable/start/modify → DC0064 Command Execution

Tunable: ServicePathRegex UserContextList CommandNameList

AN1577 macOS
Detects creation or modification of LaunchDaemon or LaunchAgent plist files under /Library/LaunchDaemons/, ~/Library/LaunchAgents/, or similar. Monitors execution of launchctl, property list edits, and file permission changes.

macos:unifiedlog launchctl load/unload or plist file modification → DC0064 Command Execution
fs:fsusage file write to launchd plist paths → DC0061 File Modification

Tunable: PlistPathList PlistKeyMonitor UnsignedBinaryAlert

AN1578 Containers
Detects creation of new container system processes via docker run --restart, kubectl exec to init containers, or modification of container init specs. Flags container images that override entrypoints to embed persistence behaviors.

docker:events docker run with restart=always or modifying init → DC0072 Container Creation
auditd:SYSCALL modification of entrypoint scripts or init containers → DC0061 File Modification

Tunable: EntrypointOverridePattern RestartPolicyMatch KubeInitModPath

Sigma rules tagged `attack.t1543` (9)

PUA - System Informer Driver Load mediumtest

Author: Florian Roth (Nextron Systems) · 2023-05-08 (modified 2024-11-23) · logsource: product=windows category=driver_load · 10cb6535-b31d-4512-9962-513dcbc42cc1

Detects driver load of the System Informer tool

Techniques: T1543

PUA - System Informer Execution mediumtest

Author: Florian Roth (Nextron Systems) · 2023-05-08 (modified 2024-11-23) · logsource: product=windows category=process_creation · 5722dff1-4bdd-4949-86ab-fbaf707e767a

Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations

Techniques: T1082 T1564 T1543

PUA - Process Hacker Driver Load hightest

Author: Florian Roth (Nextron Systems) · 2022-11-16 (modified 2024-11-23) · logsource: product=windows category=driver_load · 67add051-9ee7-4ad3-93ba-42935615ae8d

Detects driver load of the Process Hacker tool

Techniques: T1543

CVE tags: CVE-2021-21551

Service Installed By Unusual Client - System hightest

Author: Tim Rauch (Nextron Systems), Elastic (idea) · 2022-09-15 (modified 2023-01-04) · logsource: product=windows service=system · 71c276aa-49cd-43d2-b920-2dcd3e6962d5

Detects a service installed by a client which has PID 0 or whose parent has PID 0

Techniques: T1543

PUA - Process Hacker Execution mediumtest

Author: Florian Roth (Nextron Systems) · 2022-10-10 (modified 2024-11-23) · logsource: product=windows category=process_creation · 811e0002-b13b-4a15-9d00-a613fce66e42

Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors abused older vulnerable versions to manipulate system processes.

Techniques: T1622 T1564 T1543

CodeIntegrity - Blocked Driver Load With Revoked Certificate hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-06 · logsource: product=windows service=codeintegrity-operational · 9b72b82d-f1c5-4632-b589-187159bc6ec1

Detects blocked load attempts of revoked drivers

Techniques: T1543

Service Installed By Unusual Client - Security hightest

Author: Tim Rauch (Nextron Systems), Elastic (idea) · 2022-09-15 (modified 2023-01-04) · logsource: product=windows service=security · c4e92a97-a9ff-4392-9d2d-7a4c642768ca

Detects a service installed by a client which has PID 0 or whose parent has PID 0

Techniques: T1543

CodeIntegrity - Blocked Image/Driver Load For Policy Violation hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-11-10 (modified 2023-06-07) · logsource: product=windows service=codeintegrity-operational · e4be5675-4a53-426a-8c81-a8bb2387e947

Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy.

Techniques: T1543

KrbRelayUp Service Installation hightest

Author: Sittikorn S, Tim Shelton · 2022-05-11 (modified 2022-10-05) · logsource: product=windows service=system · e97d9903-53b2-41fc-8cb9-889ed4093e80

Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings)

Techniques: T1543

T1566.001 Spearphishing Attachment exploitation technique

DET0236 Detection Strategy for Spearphishing Attachment across OS Platforms
AN0655 Windows
Detection of spearphishing attachments by correlating suspicious email delivery with subsequent file creation and abnormal process execution (e.g., Office spawning PowerShell or CMD). Behavior chain includes inbound email metadata → attachment stored on disk → process execution → outbound network activity.

m365:unified Send/Receive: Inbound emails with attachments from suspicious or spoofed senders → DC0038 Application Log Content
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: AttachmentExtensions SuspiciousParentChildPairs TimeWindow

AN0656 Linux
Phishing attachments executed on Linux systems are detected by linking email logs to file creation in mail directories and subsequent suspicious process execution. Look for unexpected binaries or scripts spawned from user mail directories and anomalous outbound network activity.

Application:Mail Inbound email attachments logged from MTAs with suspicious metadata → DC0038 Application Log Content
auditd:SYSCALL execve: Execution of files saved in mail or download directories → DC0032 Process Creation
NSM:Flow Outbound traffic from suspicious new processes post-attachment execution → DC0078 Network Traffic Flow

Tunable: AttachmentStoragePaths ScriptInterpreters

AN0657 macOS
Phishing attachment detection on macOS through correlation of Mail app logs, file creation in user directories, and abnormal process execution (e.g., Preview.app or Mail.app spawning Terminal or scripting binaries). Network traffic after attachment interaction is also monitored.

macos:unifiedlog Inbound messages with attachments from suspicious domains → DC0038 Application Log Content
macos:unifiedlog Execution of Terminal, osascript, or other interpreters originating from Mail or Preview → DC0032 Process Creation
macos:unifiedlog Attachment files written to ~/Downloads or temporary folders → DC0039 File Creation

Tunable: ExecutionDelayThreshold SuspiciousParentApps

Sigma rules tagged `attack.t1566.001` (24)

Suspicious HWP Sub Processes hightest

Author: Florian Roth (Nextron Systems) · 2019-10-24 (modified 2021-11-27) · logsource: product=windows category=process_creation · 023394c4-29d5-46ab-92b8-6a534c6f447b

Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation

Techniques: T1566.001 T1203 T1059.003

ISO Image Mounted mediumtest

Author: Syed Hasan (@syedhasan009) · 2021-05-29 (modified 2023-11-09) · logsource: product=windows service=security · 0248a7bc-8a9a-4cd8-a57e-3ae8e073a073

Detects the mount of an ISO image on an endpoint

Techniques: T1566.001

Office Macro File Download lowtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-01-23 (modified 2025-10-29) · logsource: product=windows category=file_event · 0e29e3a7-1ad8-40aa-b691-9f82ecd33d66

Detects the creation of a new office macro files on the system via an application (browser, mail client). This can help identify potential malicious activity, such as the download of macro-enabled documents that could be used for exploitation.

Techniques: T1566.001

Suspicious Double Extension File Execution highstable

Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems) · 2019-06-26 (modified 2025-05-30) · logsource: product=windows category=process_creation · 1cdd9a09-06c9-4769-99ff-626e2b3991b8

Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spear phishing campaigns

Techniques: T1566.001

Arbitrary Shell Command Execution Via Settingcontent-Ms mediumtest

Author: Sreeman · 2020-03-13 (modified 2022-04-14) · logsource: product=windows category=process_creation · 24de4f3b-804c-4165-b442-5a06a2302c7e

The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.

Techniques: T1204 T1566.001

Windows Registry Trust Record Modification mediumtest

Author: Antonlovesdnb, Trent Liffick (@tliffick) · 2020-02-19 (modified 2023-06-21) · logsource: product=windows category=registry_event · 295a59c1-7b79-4b47-a930-df12c15fc9c2

Alerts on trust record modification within the registry, indicating usage of macros

Techniques: T1566.001

ISO File Created Within Temp Folders hightest

Author: @sam0x90 · 2022-07-30 · logsource: product=windows category=file_event · 2f9356ae-bf43-41b8-b858-4496d83b2acb

Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from end-July 2022.

Techniques: T1566.001

Suspicious Email Delivered In Microsoft 365 mediumexperimental

Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) · 2026-01-27 · logsource: product=m365 service=audit · 3569aefd-e535-4391-8c18-24bd01a21eaf

Detects instances where an email, identified as malicious or suspicious by the Microsoft Defender for Office 365 (formerly ATP) engine, was delivered to a user's Inbox or Junk folder. It might indicate that a potential threat, such as a spearphishing attachment or links, has bypassed initial blocking mechanisms and reached an end-user, requiring further investigation and potential remediation.

Techniques: T1566.001 T1566.002

ISO or Image Mount Indicator in Recent Files mediumtest

Author: Florian Roth (Nextron Systems) · 2022-02-11 · logsource: product=windows category=file_event · 4358e5a5-7542-4dcb-b9f3-87667371839b

Detects the creation of recent element file that points to an .ISO, .IMG, .VHD or .VHDX file as often used in phishing attacks. This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files.

Techniques: T1566.001

HTML Help HH.EXE Suspicious Child Process hightest

Author: Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems) · 2020-04-01 (modified 2023-04-12) · logsource: product=windows category=process_creation · 52cad028-0ff0-4854-8f67-d25dfcbc78b4

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

Techniques: T1047 T1059.001 T1059.003 T1059.005 T1059.007 T1218 T1218.001 T1218.010 T1218.011 T1566 T1566.001

HTML File Opened From Download Folder lowexperimental

Author: Joseph Kamau · 2025-12-05 · logsource: product=windows category=process_creation · 538c5851-8c03-4724-8ec4-623bc7aadaea

Detects web browser process opening an HTML file from a user's Downloads folder. This behavior is could be associated with phishing attacks where threat actors send HTML attachments to users. When a user opens such an attachment, it can lead to the execution of malicious scripts or the download of malware. During investigation, analyze the HTML file for embedded scripts or links, check for any subsequent downloads or process executions, and investigate the source of the email or message containing the attachment.

Techniques: T1598.002 T1566.001

Password Protected ZIP File Opened (Email Attachment) hightest

Author: Florian Roth (Nextron Systems) · 2022-05-09 · logsource: product=windows service=security · 571498c8-908e-40b4-910b-d2369159a3da

Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.

Techniques: T1027 T1566.001

Droppers Exploiting CVE-2017-11882 criticalstable

Author: Florian Roth (Nextron Systems) · 2017-11-23 (modified 2021-11-27) · logsource: product=windows category=process_creation · 678eb5f4-8597-4be6-8be7-905e4234b53a

Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe

Techniques: T1203 T1204.002 T1566.001

CVE tags: CVE-2017-11882

Exploit for CVE-2017-0261 mediumtest

Author: Florian Roth (Nextron Systems) · 2018-02-22 (modified 2021-11-27) · logsource: product=windows category=process_creation · 864403a1-36c9-40a2-a982-4c9a45f7d833

Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and CVE-2017-0262

Techniques: T1203 T1204.002 T1566.001

CVE tags: CVE-2017-0261

Office Macro File Creation lowtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-01-23 (modified 2026-01-09) · logsource: product=windows category=file_event · 91174a41-dc8f-401b-be89-7bfc140612a0

Detects the creation of a new office macro files on the systems

Techniques: T1566.001

All 24 rules on the technique page →

Sigma rules tagged with this CVE directly

3 rules carry cve.2025-33053.

Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-06-13 · logsource: product=windows category=image_load · 04fc4b22-91a6-495a-879d-0144fec5ec03

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from attacker-controlled WebDAV servers loading the Windows system DLLs like gdi32.dll, netapi32.dll, etc.

Techniques: T1218 T1105

CVE tags: CVE-2025-33053

Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-06-13 · logsource: product=windows category=process_access · 9a2d8b3e-f5a1-4c68-9e21-7d9e1cf8a123

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 by looking for process access that involves legitimate Windows executables (iediagcmd.exe, CustomShellHost.exe) accessing suspicious executables hosted on WebDAV shares. This indicates an attacker may be exploiting Process.Start() search order manipulation to execute malicious code from attacker-controlled WebDAV servers instead of legitimate system binaries. The vulnerability allows unauthorized code execution through external control of file names or paths via WebDAV.

Techniques: T1218 T1105

CVE tags: CVE-2025-33053

Potential Exploitation of RCE Vulnerability CVE-2025-33053 highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-06-13 · logsource: product=windows category=process_creation · abe06362-a5b9-4371-8724-ebd00cd48a04

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 which involves unauthorized code execution via WebDAV through external control of file names or paths. The exploit abuses legitimate utilities like iediagcmd.exe or CustomShellHost.exe by manipulating their working directories to point to attacker-controlled WebDAV servers, causing them to execute malicious executables (like route.exe) from the WebDAV path instead of legitimate system binaries through Process.Start() search order manipulation.

Techniques: T1218 T1105

CVE tags: CVE-2025-33053

CVE-2025-33053 Mapped Sigma

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1041 Exfiltration Over C2 Channel secondary impact

Sigma rules tagged attack.t1041 (5)

T1056.001 Keylogging secondary impact

Sigma rules tagged attack.t1056.001 (3)

T1059 Command and Scripting Interpreter primary impact

Sigma rules tagged attack.t1059 (95)

T1543 Create or Modify System Process secondary impact

Sigma rules tagged attack.t1543 (9)

T1566.001 Spearphishing Attachment exploitation technique

Sigma rules tagged attack.t1566.001 (24)

Sigma rules tagged with this CVE directly

Sigma rules tagged `attack.t1041` (5)

Sigma rules tagged `attack.t1056.001` (3)

Sigma rules tagged `attack.t1059` (95)

Sigma rules tagged `attack.t1543` (9)

Sigma rules tagged `attack.t1566.001` (24)