Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1203

Exploitation for Client Execution

Execution 83 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
elastic Multiple DHCP Servers Responding to the Same Transaction production 2026-10-06
splunk Cisco Secure Firewall - Malware File Downloaded production 2026-09-22
splunk Cisco Secure Firewall - Binary File Type Download production 2026-09-22
elastic Execution of File Written or Modified by Microsoft Office production 2026-09-18
elastic Potential Git CVE-2025-48384 Exploitation production 2026-09-18
elastic Anomalous Windows Process Creation production 2026-09-18
elastic Suspicious macOS MS Office Child Process production 2026-09-18
elastic Suspicious Browser Child Process production 2026-09-18
elastic Potential Shell via Wildcard Injection Detected production 2026-09-18
elastic Suspicious Execution from Foomatic-rip or Cupsd Parent production 2026-09-18
elastic Cupsd or Foomatic-rip Shell Execution production 2026-09-18
elastic Printer User (lp) Shell Execution production 2026-09-18
elastic File Creation by Cups or Foomatic-rip Child production 2026-09-18
elastic Segfault from Sensitive Process Detected production 2026-09-18
elastic Network Connection by Cups or Foomatic-rip Child production 2026-09-18
elastic Suspicious Process Execution by Zoom production 2026-09-18
elastic Potential Java Service Exploitation via Suspicious Child Process production 2026-09-18
elastic Potential SAP NetWeaver Exploitation production 2026-09-18
elastic Potential SAP NetWeaver WebShell Creation production 2026-09-18
elastic Potential CVE-2025-33053 Exploitation production 2026-09-18
elastic Suspicious MS Office Child Process production 2026-09-18
elastic Suspicious PDF Reader Child Process production 2026-09-18
elastic Potential Notepad Markdown RCE Exploitation production 2026-09-18
elastic WPS Office Exploitation via DLL Hijack production 2026-09-18
elastic Potential Foxmail Exploitation production 2026-09-18
elastic Unusual Executable File Creation by a System Critical Process production 2026-09-18
elastic Suspicious Zoom Child Process production 2026-09-18
elastic Suspicious Communication App Child Process production 2026-09-18
elastic Exploit - Prevented - Elastic Endgame production 2026-09-18
elastic Exploit - Detected - Elastic Endgame production 2026-09-18
sigma Antivirus - Remote Access Tools Signature experimental 2026-06-15
sigma Antivirus - APT Malware Signature experimental 2026-06-15
sigma Antivirus - Exploitation Framework Signature stable 2026-06-15
splunk Detect Windows DNS SIGRed via Splunk Stream experimental 2026-05-13
splunk Cisco Secure Firewall - Repeated Blocked Connections production 2026-05-13
splunk Detect Windows DNS SIGRed via Zeek experimental 2026-05-13
splunk Cisco Secure Firewall - High Priority Intrusion Classification production 2026-05-13
splunk Cisco Secure Firewall - Possibly Compromised Host experimental 2026-05-13
splunk Cisco Secure Firewall - Citrix NetScaler Memory Overread Attempt production 2026-05-13
splunk Sunburst Correlation DLL and Network Event experimental 2026-05-13
splunk Windows MSC EvilTwin Directory Path Manipulation production 2026-05-13
splunk Windows Remote Image Load production 2026-05-13
splunk Cisco Secure Firewall - Blocked Connection production 2026-05-13
elastic Deprecated - Potential curl CVE-2023-38545 Exploitation deprecated 2026-02-04
sigma Shai-Hulud Malicious Bun Execution - Linux experimental 2025-11-25
sigma Suspicious ArcSOC.exe Child Process experimental 2025-11-25
sigma Shai-Hulud Malicious Bun Execution experimental 2025-11-25
sigma OMIGOD HTTP No Authentication RCE - CVE-2021-38647 stable 2025-11-03
sigma Exploitation Activity of CVE-2025-59287 - WSUS Deserialization experimental 2025-10-31
sigma Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process experimental 2025-10-31
sigma Office Application Initiated Network Connection To Non-Local IP test 2025-10-17
sigma Suspicious Download and Execute Pattern via Curl/Wget experimental 2025-06-17
sigma Potential Exploitation of CVE-2025-4427/4428 Ivanti EPMM Pre-Auth RCE experimental 2025-05-20
snort ET TROJAN AsyncRAT Installer Payload Request rev 1 2025-03-06
suricata ET MALWARE AsyncRAT Installer Payload Request rev 1 2025-03-06
sigma Suspicious Invocation of Shell via Rsync experimental 2025-01-18
sigma Suspicious Spool Service Child Process test 2024-12-01
sigma Network Connection Initiated By Eqnedt32.EXE test 2024-05-31
sigma Potentially Suspicious Child Process of KeyScrambler.exe test 2024-05-13
sigma Dfsvc.EXE Network Connection To Non-Local IPs test 2024-03-12
sigma Dfsvc.EXE Initiated Network Connection Over Uncommon Port test 2024-01-31
sigma CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process test 2024-01-22
sigma Potentially Suspicious Child Process Of WinRAR.EXE test 2023-08-31
sigma CVE-2021-31979 CVE-2021-33771 Exploits test 2023-08-17
sigma Download From Suspicious TLD - Blacklist test 2023-05-18
sigma Download From Suspicious TLD - Whitelist test 2023-05-18
sigma Suspicious Browser Child Process - MacOS test 2023-04-05
sigma Potential CVE-2021-26857 Exploitation Attempt stable 2023-02-07
sigma Java Running with Remote Debugging test 2023-02-01
sigma Audit CVE Event test 2022-10-22
sigma CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum test 2022-10-09
sigma CVE-2021-26858 Exchange Exploitation test 2022-10-09
sigma OMIGOD SCX RunAsProvider ExecuteShellCommand test 2022-10-05
sigma OMIGOD SCX RunAsProvider ExecuteScript test 2022-10-05
sigma Exploit for CVE-2017-8759 test 2021-11-27
sigma Droppers Exploiting CVE-2017-11882 stable 2021-11-27
sigma Exploit for CVE-2017-0261 test 2021-11-27
sigma Suspicious HWP Sub Processes test 2021-11-27
sentinel Application Gateway WAF - XSS Detection Scheduled —
sentinel Vulnerable Machines related to OMIGOD CVE-2021-38647 Scheduled —
sentinel Prestige ransomware IOCs Oct 2022 Scheduled —
sentinel Malformed user agent Scheduled —
sentinel PE file dropped in Color Profile Folder Scheduled —