ATT&CK technique
View on MITRE ATT&CK →
T1204.001
Malicious Link
Execution
9 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Google Workspace Object Copied from External Drive with App Consent | production | 2026-09-24 |
| elastic | Network Traffic to Rare Destination Country | production | 2026-09-18 |
| elastic | XDG-Open Command Execution | production | 2026-09-18 |
| splunk | Windows PowerShell FakeCAPTCHA Clipboard Execution | production | 2026-07-14 |
| splunk | Windows ISO LNK File Creation | production | 2026-05-13 |
| sigma | Potential ClickFix Execution Pattern - Registry | experimental | 2025-11-19 |
| sigma | Suspicious ClickFix/FileFix Execution Pattern | experimental | 2025-11-19 |
| sigma | Suspicious Execution via macOS Script Editor | test | 2022-12-28 |
| sigma | Symlink Etc Passwd | test | 2021-11-27 |