ATT&CK technique
View on MITRE ATT&CK →
T1587.001
Malware
Resource Development
13 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | GenAI Process Compiling or Generating Executables | production | 2026-09-25 |
| splunk | Cisco Secure Firewall - Possibly Compromised Host | experimental | 2026-05-13 |
| sigma | Potential PsExec Remote Execution | test | 2025-09-01 |
| sigma | Creation of an Executable by an Executable | test | 2025-02-24 |
| sigma | Potential Privilege Escalation To LOCAL SYSTEM | test | 2024-03-05 |
| sigma | PsExec/PAExec Escalation to LOCAL SYSTEM | test | 2024-03-05 |
| sigma | Uncommon File Created In Office Startup Folder | test | 2023-12-13 |
| sigma | VHD Image Download Via Browser | test | 2023-05-05 |
| sigma | PUA - CsExec Execution | test | 2023-02-21 |
| sigma | ProxyLogon MSExchange OabVirtualDirectory | test | 2023-01-23 |
| sigma | Formbook Process Creation | test | 2022-10-06 |
| sigma | Mustang Panda Dropper | test | 2021-11-27 |
| sigma | Conti Volume Shadow Listing | test | 2021-08-09 |