Which SIEM platforms have a T1204 detection rule?

df00tech provides T1204 (User Execution) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect User Execution (T1204)?

Detecting User Execution requires the following data sources: Process: Process Creation, Microsoft Defender for Endpoint.

What severity and confidence is the T1204 detection?

The T1204 detection is rated high severity with high confidence.

What are common false positives for T1204?

Common false positives for T1204 include: Legitimate IT-deployed remote access tools (AnyDesk, TeamViewer, ScreenConnect) installed by helpdesk staff — these should appear with MSI/SCCM parent processes rather than browsers or explorer.exe; Developers running scripts directly from their Downloads or Desktop folder — allowlist known developer workstations or specific AccountNames with documented exceptions; Office macros used by finance or operations teams for legitimate automation — document and allowlist specific macro-enabled workbooks and the user accounts that run them.

T1204

User Execution

Execution Last updated: April 19, 2026

Adversaries rely on specific actions by a user to gain execution. Users are subjected to social engineering to execute malicious code by opening malicious document files, clicking links, running copy-pasted commands, or installing remote access tools under false pretenses. This technique frequently follows phishing (T1566) and encompasses a wide range of deceptive methods including malicious Office documents spawning shells, fake CAPTCHAs instructing users to paste PowerShell into Run dialogs (ClickFix/ClearFake), tech support scams prompting RAT installation, and malicious LNK files on removable media. Threat groups including Scattered Spider, LAPSUS$, and malware families like Lumma Stealer and Raspberry Robin rely heavily on user-initiated execution to bypass automated defenses.

What is T1204 User Execution?

User Execution (T1204) maps to the Execution tactic — the adversary is trying to run malicious code in MITRE ATT&CK.

This page provides production-ready detection logic for User Execution, covering the data sources and telemetry it touches: Process: Process Creation, Microsoft Defender for Endpoint. The queries below are rated high severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Execution
Technique: T1204 User Execution
Canonical reference: https://attack.mitre.org/techniques/T1204/

Microsoft Sentinel / Defender

kusto

let OfficeAndDocApps = dynamic([
  "WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "OUTLOOK.EXE",
  "MSPUB.EXE", "ONENOTE.EXE", "VISIO.EXE",
  "acrord32.exe", "acrobat.exe", "foxitreader.exe",
  "chrome.exe", "msedge.exe", "firefox.exe", "iexplore.exe", "opera.exe"
]);
let ShellInterpreters = dynamic([
  "cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe",
  "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe",
  "certutil.exe", "bitsadmin.exe"
]);
let RATBinaries = dynamic([
  "anydesk.exe", "teamviewer.exe", "screenconnect.exe",
  "connectwisecontrol.exe", "splashtopstreamer.exe", "ultraviewer.exe",
  "rustdesk.exe", "supremo.exe", "ammyy admin.exe", "radmin.exe",
  "atera_agent.exe", "level.exe", "fleetdeck.exe", "netsupport.exe"
]);
let UserWritablePaths = dynamic([
  "\\Downloads\\", "\\Desktop\\",
  "\\AppData\\Local\\Temp\\", "\\Users\\Public\\",
  "\\AppData\\Roaming\\"
]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| extend IsOfficeOrBrowserParent = InitiatingProcessFileName has_any (OfficeAndDocApps)
| extend IsShellChild = FileName has_any (ShellInterpreters)
| extend IsRATExecution = FileName has_any (RATBinaries)
| extend IsUserDirExec = FolderPath has_any (UserWritablePaths)
    and FileName endswith ".exe"
    and InitiatingProcessFileName =~ "explorer.exe"
// Exclude common legitimate browser-spawned updaters
| where not (
    IsUserDirExec
    and FileName in~ ("OneDriveSetup.exe", "Teams.exe", "Slack.exe",
                      "Zoom.exe", "update.exe", "setup.exe")
  )
| extend OfficeShellSpawn = IsOfficeOrBrowserParent and IsShellChild
| where OfficeShellSpawn or IsRATExecution or IsUserDirExec
| extend DetectionCategory = case(
    OfficeShellSpawn, "Office/Browser Shell Spawn",
    IsRATExecution, "Remote Access Tool Execution (Possible Social Engineering)",
    "Executable Launched from User-Writable Directory"
  )
| project Timestamp, DeviceName, AccountName, FileName, FolderPath,
          ProcessCommandLine, InitiatingProcessFileName,
          InitiatingProcessCommandLine, DetectionCategory
| sort by Timestamp desc

Detects three primary User Execution patterns using Microsoft Defender for Endpoint DeviceProcessEvents. First, it identifies Office applications, PDF readers, and browsers spawning shell interpreters (cmd, PowerShell, wscript, mshta), which is the classic malicious document execution chain. Second, it detects known remote access tool (RAT) binaries being executed from user-facing parent processes, consistent with tech support scam or social engineering scenarios used by Scattered Spider and LAPSUS$. Third, it identifies arbitrary executables launched by explorer.exe (user double-clicked) from user-writable paths such as Downloads and Desktop, which are common staging directories for delivered payloads.

high severity high confidence

Data Sources

Process: Process Creation Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

Legitimate IT-deployed remote access tools (AnyDesk, TeamViewer, ScreenConnect) installed by helpdesk staff — these should appear with MSI/SCCM parent processes rather than browsers or explorer.exe
Developers running scripts directly from their Downloads or Desktop folder — allowlist known developer workstations or specific AccountNames with documented exceptions
Office macros used by finance or operations teams for legitimate automation — document and allowlist specific macro-enabled workbooks and the user accounts that run them
Browser-spawned update helpers or credential managers that briefly launch from AppData\Roaming — build a baseline of expected binaries per application

Splunk

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval ParentImageLower=lower(ParentImage)
| eval ImageLower=lower(Image)
| eval CommandLineLower=lower(CommandLine)
| eval FolderPath=lower(replace(Image, "[^\\\\/]+$", ""))
| eval IsOfficeOrBrowserParent=if(
    match(ParentImageLower,
      "(winword\.exe|excel\.exe|powerpnt\.exe|outlook\.exe|mspub\.exe|onenote\.exe|visio\.exe|acrord32\.exe|acrobat\.exe|foxitreader\.exe|chrome\.exe|msedge\.exe|firefox\.exe|iexplore\.exe|opera\.exe)"),
    1, 0)
| eval IsShellChild=if(
    match(ImageLower,
      "(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe)"),
    1, 0)
| eval IsRATExecution=if(
    match(ImageLower,
      "(anydesk\.exe|teamviewer\.exe|screenconnect\.exe|connectwisecontrol\.exe|splashtopstreamer\.exe|ultraviewer\.exe|rustdesk\.exe|supremo\.exe|radmin\.exe|atera_agent\.exe|netsupport\.exe)"),
    1, 0)
| eval IsUserDirExec=if(
    match(lower(Image), "(\\\\downloads\\\\|\\\\desktop\\\\|\\\\appdata\\\\local\\\\temp\\\\|\\\\users\\\\public\\\\|\\\\appdata\\\\roaming\\\\)")
    AND match(ImageLower, "\.exe$")
    AND match(ParentImageLower, "explorer\.exe"),
    1, 0)
| eval OfficeShellSpawn=if(IsOfficeOrBrowserParent=1 AND IsShellChild=1, 1, 0)
| where OfficeShellSpawn=1 OR IsRATExecution=1 OR IsUserDirExec=1
| eval DetectionCategory=case(
    OfficeShellSpawn=1, "Office/Browser Shell Spawn",
    IsRATExecution=1, "Remote Access Tool Execution",
    1=1, "Executable from User-Writable Directory")
| where NOT (IsUserDirExec=1 AND match(ImageLower, "(onedrive|teams\.exe|slack\.exe|zoom\.exe|update\.exe|setup\.exe)"))
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, DetectionCategory
| sort - _time

Detects User Execution patterns using Sysmon Event ID 1 (Process Creation) in Splunk. Evaluates three detection categories: Office or browser applications spawning shell interpreters (strong indicator of malicious document execution), known remote access tool binaries launched interactively (consistent with social engineering campaigns by Scattered Spider and LAPSUS$), and executables double-clicked by users from writable directories like Downloads, Desktop, and AppData Temp. The eval chain builds boolean indicators per event and a DetectionCategory label to triage without ambiguity.

high severity high confidence

Data Sources

Process: Process Creation Sysmon Event ID 1

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives

Helpdesk-deployed remote access tools installed by IT through approved channels — parent process will be msiexec.exe or a management agent rather than browser or explorer.exe
Developers running build scripts or installers directly from Desktop or Downloads — expected on developer workstations; scope alerts to non-developer OUs or asset groups
Finance team Excel macros invoking cmd.exe for legacy automation — document and exclude specific workbook paths and associated user accounts after review
Browser extensions that spawn helper processes — typically spawn from a versioned subdirectory of AppData, not the root Downloads or Desktop paths

Elastic Security (EQL)

eql

sequence by host.id with maxspan=5s
  [process where event.type == "start" and
    process.parent.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "OUTLOOK.EXE",
                            "MSPUB.EXE", "ONENOTE.EXE", "VISIO.EXE",
                            "acrord32.exe", "acrobat.exe", "foxitreader.exe",
                            "chrome.exe", "msedge.exe", "firefox.exe", "iexplore.exe", "opera.exe") and
    process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe",
                    "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe",
                    "certutil.exe", "bitsadmin.exe")] by process.parent.entity_id

pipe

process where event.type == "start" and
  process.name : ("anydesk.exe", "teamviewer.exe", "screenconnect.exe",
                  "connectwisecontrol.exe", "splashtopstreamer.exe", "ultraviewer.exe",
                  "rustdesk.exe", "supremo.exe", "radmin.exe", "atera_agent.exe",
                  "netsupport.exe", "level.exe", "fleetdeck.exe")

pipe

process where event.type == "start" and
  process.parent.name : "explorer.exe" and
  process.name : "*.exe" and
  process.executable : ("*\\Downloads\\*", "*\\Desktop\\*",
                         "*\\AppData\\Local\\Temp\\*", "*\\Users\\Public\\*",
                         "*\\AppData\\Roaming\\*") and
  not process.name : ("OneDriveSetup.exe", "Teams.exe", "Slack.exe",
                       "Zoom.exe", "update.exe", "setup.exe")

Detects T1204 User Execution via three correlated patterns: (1) office application or browser spawning shell interpreters indicating malicious document/phishing execution, (2) remote access tool (RAT) execution commonly used in tech support scams and social engineering, and (3) executables launched from user-writable directories via Explorer suggesting downloaded malware or ClickFix/ClearFake payloads. Uses EQL sequences for office/shell correlation and standalone process events for RAT and user-directory checks.

high severity high confidence

Data Sources

Elastic Endpoint Security Winlogbeat with Sysmon Elastic Agent (endpoint integration)

Required Tables

logs-endpoint.events.process-* winlogbeat-* logs-windows.*

False Positives

Legitimate macro-enabled Office documents used by finance or HR teams that spawn cmd.exe for scripted data exports or report generation
IT administrators deploying TeamViewer, AnyDesk, or ScreenConnect for authorized remote support — especially common during onboarding or helpdesk workflows
Developers running executables from Downloads or Desktop during software evaluation, testing, or personal productivity workflows on unmanaged endpoints

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  "username",
  "sourceip",
  QIDNAME(qid) AS event_name,
  "ParentImage",
  "Image",
  "CommandLine",
  CASE
    WHEN LOWER("ParentImage") MATCHES REGEX '(winword\.exe|excel\.exe|powerpnt\.exe|outlook\.exe|mspub\.exe|onenote\.exe|visio\.exe|acrord32\.exe|acrobat\.exe|foxitreader\.exe|chrome\.exe|msedge\.exe|firefox\.exe|iexplore\.exe|opera\.exe)'
         AND LOWER("Image") MATCHES REGEX '(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe)'
      THEN 'Office/Browser Shell Spawn'
    WHEN LOWER("Image") MATCHES REGEX '(anydesk\.exe|teamviewer\.exe|screenconnect\.exe|connectwisecontrol\.exe|splashtopstreamer\.exe|ultraviewer\.exe|rustdesk\.exe|supremo\.exe|radmin\.exe|atera_agent\.exe|netsupport\.exe)'
      THEN 'Remote Access Tool Execution'
    WHEN LOWER("ParentImage") MATCHES REGEX 'explorer\.exe'
         AND LOWER("Image") MATCHES REGEX '\.exe$'
         AND LOWER("Image") MATCHES REGEX '(\\\\downloads\\\\|\\\\desktop\\\\|\\\\appdata\\\\local\\\\temp\\\\|\\\\users\\\\public\\\\|\\\\appdata\\\\roaming\\\\)'
         AND NOT LOWER("Image") MATCHES REGEX '(onedrive|teams\.exe|slack\.exe|zoom\.exe|update\.exe|setup\.exe)'
      THEN 'Executable from User-Writable Directory'
    ELSE 'Unknown'
  END AS detection_category
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) IN (12, 13, 119)
  AND "EventID" = '1'
  AND LONG(starttime) >= LONG(NOW()) - 86400000
  AND (
    (
      LOWER("ParentImage") MATCHES REGEX '(winword\.exe|excel\.exe|powerpnt\.exe|outlook\.exe|mspub\.exe|onenote\.exe|visio\.exe|acrord32\.exe|acrobat\.exe|foxitreader\.exe|chrome\.exe|msedge\.exe|firefox\.exe|iexplore\.exe|opera\.exe)'
      AND LOWER("Image") MATCHES REGEX '(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe)'
    )
    OR LOWER("Image") MATCHES REGEX '(anydesk\.exe|teamviewer\.exe|screenconnect\.exe|connectwisecontrol\.exe|splashtopstreamer\.exe|ultraviewer\.exe|rustdesk\.exe|supremo\.exe|radmin\.exe|atera_agent\.exe|netsupport\.exe)'
    OR (
      LOWER("ParentImage") MATCHES REGEX 'explorer\.exe'
      AND LOWER("Image") MATCHES REGEX '\.exe$'
      AND LOWER("Image") MATCHES REGEX '(\\\\downloads\\\\|\\\\desktop\\\\|\\\\appdata\\\\local\\\\temp\\\\|\\\\users\\\\public\\\\|\\\\appdata\\\\roaming\\\\)'
      AND NOT LOWER("Image") MATCHES REGEX '(onedrive|teams\.exe|slack\.exe|zoom\.exe|update\.exe|setup\.exe)'
    )
  )
ORDER BY starttime DESC

Detects T1204 User Execution in IBM QRadar using Sysmon Event ID 1 (Process Create) from Windows endpoints. Identifies three high-fidelity patterns: office applications or browsers spawning shell interpreters (indicating document-based phishing), execution of known remote access tools (social engineering / tech support scams), and executables launched by explorer.exe from user-writable directories. Uses AQL MATCHES REGEX for pattern matching across process image paths and CASE statements for alert categorization.

high severity high confidence

Data Sources

IBM QRadar SIEM Sysmon via Windows Event Forwarding QRadar Windows Security DSM

Required Tables

events

False Positives

Legitimate macro-enabled documents used in business workflows (e.g., Excel-based automation triggering cmd.exe for data processing pipelines in finance departments)
Authorized deployment of remote management tools such as TeamViewer or ScreenConnect by IT helpdesk teams for endpoint support
Software developers running executables from Downloads or AppData directories during local build, test, or evaluation workflows

Sumo Logic CSE

sql

_sourceCategory=windows/sysmon OR _sourceCategory=endpoint/process
| json field=_raw "EventID", "ParentImage", "Image", "CommandLine", "ParentCommandLine", "User", "Computer" nodrop
| where EventID = "1"
| toLowerCase(ParentImage) as parent_lower
| toLowerCase(Image) as image_lower
| eval office_or_browser_parent = if(
    parent_lower matches "*(winword.exe|excel.exe|powerpnt.exe|outlook.exe|mspub.exe|onenote.exe|visio.exe|acrord32.exe|acrobat.exe|foxitreader.exe|chrome.exe|msedge.exe|firefox.exe|iexplore.exe|opera.exe)*",
    1, 0)
| eval shell_child = if(
    image_lower matches "*(cmd.exe|powershell.exe|pwsh.exe|wscript.exe|cscript.exe|mshta.exe|rundll32.exe|regsvr32.exe|certutil.exe|bitsadmin.exe)*",
    1, 0)
| eval rat_execution = if(
    image_lower matches "*(anydesk.exe|teamviewer.exe|screenconnect.exe|connectwisecontrol.exe|splashtopstreamer.exe|ultraviewer.exe|rustdesk.exe|supremo.exe|radmin.exe|atera_agent.exe|netsupport.exe)*",
    1, 0)
| eval user_dir_exec = if(
    image_lower matches "*(\\downloads\\|\\desktop\\|\\appdata\\local\\temp\\|\\users\\public\\|\\appdata\\roaming\\)*"
    and image_lower matches "*.exe"
    and parent_lower matches "*explorer.exe*",
    1, 0)
| eval office_shell_spawn = if(office_or_browser_parent = 1 and shell_child = 1, 1, 0)
| where office_shell_spawn = 1 or rat_execution = 1 or user_dir_exec = 1
| where not (
    user_dir_exec = 1
    and image_lower matches "*(onedrive|teams.exe|slack.exe|zoom.exe|update.exe|setup.exe)*"
  )
| eval detection_category = if(office_shell_spawn = 1, "Office/Browser Shell Spawn",
    if(rat_execution = 1, "Remote Access Tool Execution",
      "Executable from User-Writable Directory"))
| fields _messageTime, Computer, User, Image, CommandLine, ParentImage, ParentCommandLine, detection_category
| sort by _messageTime desc

Detects T1204 User Execution in Sumo Logic using Sysmon process creation events. Evaluates three behavioral patterns aligned with common social engineering TTPs: office and browser applications spawning shell interpreters (document-based phishing), remote access tool execution (tech support scams and impersonation), and explorer-spawned executables from user-writable locations (ClickFix, drive-by downloads). Uses Sumo Logic eval and pattern matching with toLowerCase normalization for reliable case-insensitive comparisons.

high severity high confidence

Data Sources

Sumo Logic Installed Collector (Windows) Sysmon for Windows Sumo Logic Cloud SIEM Enterprise

Required Tables

_sourceCategory=windows/sysmon _sourceCategory=endpoint/process

False Positives

Legitimate business macros in Excel or Word that invoke cmd.exe or PowerShell for ETL tasks, report generation, or workflow automation in enterprise environments
IT-approved remote access tools installed as part of managed service agreements or active helpdesk support sessions
End-user installation of legitimate productivity software downloaded from the internet and run via explorer from the Downloads folder

Google Chronicle / SecOps

yaral

rule t1204_user_execution {
  meta:
    author = "Detection Engineering"
    description = "Detects T1204 User Execution via office/browser shell spawn, RAT execution, or executables from user-writable directories"
    mitre_attack_tactic = "Execution"
    mitre_attack_technique = "T1204"
    mitre_attack_technique_name = "User Execution"
    severity = "HIGH"
    priority = "HIGH"
    confidence = "HIGH"
    reference = "https://attack.mitre.org/techniques/T1204/"
    created = "2026-04-19"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.metadata.product_name = "WINDOWS"

    // Pattern 1: Office/Browser spawning shell interpreter
    (
      re.regex($e.principal.process.file.full_path,
        `(?i)(winword\.exe|excel\.exe|powerpnt\.exe|outlook\.exe|mspub\.exe|onenote\.exe|visio\.exe|acrord32\.exe|acrobat\.exe|foxitreader\.exe|chrome\.exe|msedge\.exe|firefox\.exe|iexplore\.exe|opera\.exe)$`)
      and re.regex($e.target.process.file.full_path,
        `(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe)$`)
    )
    or
    // Pattern 2: RAT binary execution (social engineering)
    re.regex($e.target.process.file.full_path,
      `(?i)(anydesk\.exe|teamviewer\.exe|screenconnect\.exe|connectwisecontrol\.exe|splashtopstreamer\.exe|ultraviewer\.exe|rustdesk\.exe|supremo\.exe|radmin\.exe|atera_agent\.exe|netsupport\.exe|level\.exe|fleetdeck\.exe)$`)
    or
    // Pattern 3: Executable launched from user-writable directory via Explorer
    (
      re.regex($e.principal.process.file.full_path, `(?i)explorer\.exe$`)
      and re.regex($e.target.process.file.full_path, `(?i)\.exe$`)
      and re.regex($e.target.process.file.full_path,
        `(?i)(\\Downloads\\|\\Desktop\\|\\AppData\\Local\\Temp\\|\\Users\\Public\\|\\AppData\\Roaming\\)`)
      and not re.regex($e.target.process.file.full_path,
        `(?i)(OneDriveSetup\.exe|Teams\.exe|Slack\.exe|Zoom\.exe|update\.exe|setup\.exe)$`)
    )

  condition:
    $e
}

Chronicle YARA-L 2.0 rule detecting T1204 User Execution across three behavioral patterns: office and browser applications spawning shell interpreters (document-based phishing and malicious macros), remote access tool execution indicating social engineering or tech support scams, and explorer-spawned executables from user-writable directories associated with ClickFix, ClearFake, and downloaded malware. Uses UDM process event fields with case-insensitive regex matching on process image paths.

high severity high confidence

Data Sources

Google Chronicle SIEM Chronicle Unified Data Model (UDM) Windows Endpoint Detection (via Chronicle Forwarder or partner ingestion)

Required Tables

PROCESS_LAUNCH UDM events

False Positives

Finance or operations teams using Excel macros that legitimately call PowerShell or cmd.exe as part of automated data processing or ERP integrations
Authorized remote desktop tools deployed by managed service providers or IT teams for legitimate support sessions, especially in organizations without centralized MDM whitelisting
Developers and power users running downloaded installers or portable tools directly from the Downloads or Desktop folder during evaluation or onboarding

CrowdStrike LogScale (CQL)

cql

// T1204 User Execution — CrowdStrike LogScale (Falcon)
// Pattern 1: Office/Browser spawning shell interpreter
#event_simpleName=ProcessRollup2
| ParentBaseFileName = /(?i)^(WINWORD|EXCEL|POWERPNT|OUTLOOK|MSPUB|ONENOTE|VISIO|acrord32|acrobat|foxitreader|chrome|msedge|firefox|iexplore|opera)\.exe$/
| ImageFileName = /(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin)\.exe$/
| eval DetectionCategory="Office/Browser Shell Spawn"
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, ParentCommandLine, DetectionCategory])

union

// Pattern 2: Remote Access Tool execution
#event_simpleName=ProcessRollup2
| ImageFileName = /(?i)(anydesk|teamviewer|screenconnect|connectwisecontrol|splashtopstreamer|ultraviewer|rustdesk|supremo|radmin|atera_agent|netsupport|level|fleetdeck)\.exe$/
| eval DetectionCategory="Remote Access Tool Execution"
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, ParentCommandLine, DetectionCategory])

union

// Pattern 3: Executable launched from user-writable directory via explorer.exe
#event_simpleName=ProcessRollup2
| ParentBaseFileName = /(?i)^explorer\.exe$/
| ImageFileName = /(?i)\.exe$/
| ImageFileName = /(?i)(\\Downloads\\|\\Desktop\\|\\AppData\\Local\\Temp\\|\\Users\\Public\\|\\AppData\\Roaming\\)/
| ImageFileName != /(?i)(OneDriveSetup|Teams|Slack|Zoom|update|setup)\.exe$/
| eval DetectionCategory="Executable from User-Writable Directory"
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, ParentCommandLine, DetectionCategory])

| sort(@timestamp, order=desc)

CrowdStrike LogScale (Falcon) detection for T1204 User Execution using ProcessRollup2 events from the Falcon sensor. Three unioned patterns cover the full threat surface: (1) office applications and browsers spawning shell interpreters indicating macro-based phishing or malicious document execution, (2) remote access tool binaries associated with social engineering and tech support scams (Scattered Spider, Lumma Stealer delivery), and (3) explorer-spawned executables from user-writable paths consistent with ClickFix paste attacks, ClearFake campaigns, and Raspberry Robin LNK execution. Results are unioned and sorted by timestamp descending for analyst triage.

high severity high confidence

Data Sources

CrowdStrike Falcon Endpoint Protection Falcon Insight XDR CrowdStrike LogScale / Humio

Required Tables

ProcessRollup2 (#event_simpleName=ProcessRollup2)

False Positives

Legitimate business use of Office macros that call PowerShell or cmd.exe for ETL, report generation, or workflow automation — especially common in finance, HR, and operations teams
IT-sanctioned deployment or active sessions of remote access tools like TeamViewer, AnyDesk, or ScreenConnect during authorized helpdesk or managed service activities
End-user execution of downloaded software installers or portable utilities from Desktop or Downloads folder, particularly during software evaluations or self-service IT tasks on non-managed systems

Sigma rule & cross-platform mapping

The detection logic for User Execution (T1204) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1204 Sigma rules on detection.fyi

Platform-specific guides for T1204

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-04-19 Research depth: deep

References (8)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Malicious Office Document Macro Spawning cmd.exe
Expected signal: Sysmon Event ID 1: wscript.exe Process Create with CommandLine containing df00tech_test.vbs. Second Sysmon Event ID 1: cmd.exe Process Create with ParentImage=wscript.exe and CommandLine containing whoami. Sysmon Event ID 11: File Create for df00tech_result.txt in %TEMP%.
Test 2Simulated ClickFix / Clipboard Paste Execution (Lumma Stealer Pattern)
Expected signal: Sysmon Event ID 1: powershell.exe Process Create with CommandLine containing '-enc' and a Base64 string. ParentImage will be powershell.exe (the launcher). PowerShell ScriptBlock Log Event ID 4104 will show decoded content 'Write-Output ClickFix-Test-df00tech'. In a real ClickFix scenario, the parent would be explorer.exe (Run dialog) spawning powershell.exe with -enc.
Test 3Remote Access Tool Execution Simulating Social Engineering
Expected signal: Sysmon Event ID 11: File Create for AnyDesk.exe in %USERPROFILE%\Downloads\ with initiating process curl.exe. Zone.Identifier ADS written to AnyDesk.exe confirming ZoneId=3 (Internet). If the binary is then executed (in a controlled lab), Sysmon Event ID 1: AnyDesk.exe Process Create with ParentImage=explorer.exe and FolderPath containing \Downloads\.
Test 4Malicious LNK File Execution from Removable Media (Raspberry Robin Pattern)
Expected signal: Sysmon Event ID 11: File Create for df00tech_lnk_test.lnk in %TEMP%. Sysmon Event ID 1: cmd.exe Process Create with ParentImage=explorer.exe (shell invocation) and CommandLine containing 'LNK-Execution-Test-df00tech'. The FolderPath for cmd.exe will be %TEMP%, which matches the user-writable path detection branch.

Response Playbook

Triage

Identify the exact execution chain — what launched the suspicious process? Trace back: email attachment → Office → cmd, or browser download → explorer.exe → RAT binary. Use DeviceProcessEvents | where DeviceId == '<id>' | where Timestamp between(ago(1h) .. now()) | sort by Timestamp asc to build the full timeline.
Examine the initiating file — if Office spawned a shell, retrieve the parent document name from InitiatingProcessCommandLine or search DeviceFileEvents for recently opened files on that device. Look for .docm, .xlsm, .doc with macros, or .lnk files in user directories.
For RAT binary detections: determine whether this is an IT-sanctioned tool by checking your CMDB or asset management system. Query the installer's parent process — was it msiexec.exe (legitimate deployment) or a browser/email client (social engineering)?
Assess the user context — was this a privileged account (domain admin, IT admin, finance)? High-privilege users executing social-engineered payloads have elevated blast radius. Cross-reference with recent helpdesk tickets or IT requests that might explain the activity.
Check for follow-on network activity — run DeviceNetworkEvents | where DeviceName == '<device>' | where Timestamp > ago(2h) to identify C2 connections, RAT callback traffic, or data exfiltration following the initial execution.
Review clipboard and Run dialog artifacts if ClickFix/ClearFake paste execution is suspected — look for powershell.exe spawned by explorer.exe or cmd.exe with Base64 payloads in the command line, which is the Lumma Stealer distribution pattern.
Correlate with email telemetry — query OfficeActivity or your email gateway logs for attachments or links delivered to this user in the preceding 24 hours to identify the delivery vector.

Containment

If active C2 or RAT callback traffic is detected: immediately isolate the endpoint using EDR network isolation to sever the connection while preserving the system for forensics.
If a RAT is running interactively: do NOT terminate the process immediately before capturing memory — take a full process memory dump and active network connections first using: procdump.exe -ma <PID> C:\Evidence\rat_dump.dmp
If the user's account credentials were entered into a fake form or the user authenticated a suspicious MFA prompt: immediately disable the account in Active Directory, revoke all active sessions in Azure AD (Revoke-AzureADUserAllRefreshToken), and reset the password.
Block the delivery infrastructure — if an email attachment or URL was the vector, submit the sender domain and hosting IPs to your email gateway and proxy blocklists. Escalate to threat intel for IOC sharing.
Identify and quarantine all copies of the malicious file across the environment using DeviceFileEvents | where SHA256 == '<hash>' to find other endpoints where the file was dropped.
If an Office macro was the entry point: deploy a GPO to disable all macros for the affected user group (Trust Center > Macro Settings > Disable all macros without notification) as an emergency measure while investigating.

Evidence Collection

Full process tree from the initiating file through all child processes — capture with: DeviceProcessEvents | where DeviceName == '<device>' | where InitiatingProcessId == <pid> or ProcessId == <pid> | sort by Timestamp asc
Sysmon Event ID 1 (Process Create) logs for the full execution chain including parent/child PID relationships, hashes, and command lines
Sysmon Event ID 11 (File Create) events showing any files dropped to disk by the malicious process, including payload staging in temp directories
Sysmon Event ID 3 (Network Connection) showing any outbound connections made by the suspicious process, with destination IPs and ports for C2 analysis
Sysmon Event ID 22 (DNS Query) to capture domain lookups made around the time of execution, which may reveal C2 domain infrastructure
Windows Security Event ID 4688 (Process Creation with command line) as a corroborating source if Sysmon is unavailable — requires command line auditing GPO enabled
Email message headers and attachments from the delivery mailbox — export the original email as .eml for hash comparison and URL extraction
Browser download history — located at %LOCALAPPDATA%\Google\Chrome\User Data\Default\History (SQLite) or equivalent for other browsers — to trace file origin URL
LNK file metadata if a shortcut was involved: use lnk-parser or Windows shortcut property extraction to reveal embedded target paths and machine of origin
Prefetch files at C:\Windows\Prefetch\<MALWARE>.EXE-*.pf showing execution timestamps and files loaded — requires prefetch to be enabled

Escalation Criteria

! Office or browser process spawned a shell that subsequently made outbound network connections — this is a full execution-to-C2 chain and requires immediate IR engagement
! Remote access tool installed by a user who has no open helpdesk ticket or change request — strong indicator of Scattered Spider or similar social engineering attack
! User account shows anomalous MFA approvals or impossible travel in Azure AD SigninLogs within the same timeframe — indicates account compromise alongside execution
! Malicious document or binary hash matches known threat actor tooling in threat intelligence feeds — auto-escalate to Tier 3 and notify security leadership
! Multiple endpoints in the same business unit show the same execution pattern within a short window — indicates a targeted phishing campaign against a specific department
! Payload executed from a high-privileged account (Domain Admin, Exchange Admin, Finance Director) — elevated urgency regardless of whether follow-on activity is confirmed

Investigation Guide

Forensic Artifacts

> Office Recent Files: HKCU\SOFTWARE\Microsoft\Office\<version>\<App>\File MRU — lists recently opened documents including malicious attachments
> Office Trusted Documents: HKCU\SOFTWARE\Microsoft\Office\<version>\<App>\Security\Trusted Documents\TrustRecords — shows documents where macros were enabled by the user
> Shell Bags / Recent Items: HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU — records folder and file access history including downloaded files
> Browser Download History: %LOCALAPPDATA%\Google\Chrome\User Data\Default\History (SQLite), %APPDATA%\Mozilla\Firefox\Profiles\<profile>\places.sqlite — shows file origin URL and download timestamp
> Prefetch: C:\Windows\Prefetch\<MALICIOUS>.EXE-*.pf — execution timestamp and DLLs/files referenced during execution
> Zone.Identifier Alternate Data Stream: <downloaded_file>:Zone.Identifier — records the download URL and zone (ZoneId=3 = Internet) for files from the web, confirming file origin
> Windows Event ID 4688 (Security log) — process creation with command line if audit process creation policy is enabled
> Sysmon Event ID 1 — full process creation including hash, parent, command line; Sysmon Event ID 11 — file creation events for dropped payloads
> Email artifacts: Outlook OST/PST at %LOCALAPPDATA%\Microsoft\Outlook\, .eml files in temp folders — recoverable attachment metadata even if email deleted
> LNK files in %APPDATA%\Microsoft\Windows\Recent\ — Windows automatically creates shortcut files for recently accessed items, recording target path and volume serial number

Tuning Guidance

Begin by building a baseline of approved remote access tools and their expected deployment parent processes in your environment. Legitimate helpdesk tools deployed by IT will originate from msiexec.exe, SCCM (ccmexec.exe), or Intune management agents — never from chrome.exe or explorer.exe. Create an allowlist of these sanctioned parent-child pairs and suppress them from the RAT detection branch. For Office shell spawn detections, the most common legitimate source of false positives is finance or operations teams using macro-enabled workbooks. Work with business units to enumerate approved macro workbooks and either migrate them to Power Automate or explicitly allowlist the specific file hashes and user accounts involved. For the user-writable directory execution branch, consider scoping alerts only to non-developer device groups using your EDR's device tag or organizational unit filtering. On the SPL side, use a lookup table (rat_allowlist.csv) to suppress known-good RAT deployments by host and user combination. Tune the time window from 24h to 1h during active incident investigation to reduce noise. Consider adding severity tiers: Office spawning encoded PowerShell = Critical, Office spawning cmd.exe = High, RAT from browser parent = High, executable from Downloads = Medium.

Hunting Queries

Hunt for trending office and browser applications spawning shell interpreters, aggregated by hour. A spike in a specific hour window may indicate an active phishing campaign targeting multiple users. High AffectedDevices or AffectedUsers values suggest a broad campaign rather than a one-off incident.

Hunting — KQL

kql

DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE",
    "OUTLOOK.EXE", "acrord32.exe", "acrobat.exe",
    "chrome.exe", "msedge.exe", "firefox.exe", "iexplore.exe")
| summarize
    SpawnedProcesses = make_set(FileName),
    UniqueShells = dcountif(FileName, FileName in~ ("cmd.exe", "powershell.exe",
        "wscript.exe", "cscript.exe", "mshta.exe")),
    TotalEvents = count(),
    AffectedDevices = dcount(DeviceName),
    AffectedUsers = dcount(AccountName)
    by InitiatingProcessFileName, bin(Timestamp, 1h)
| where UniqueShells > 0
| sort by TotalEvents desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (ParentImage="*\\WINWORD.EXE" OR ParentImage="*\\EXCEL.EXE" OR ParentImage="*\\POWERPNT.EXE"
   OR ParentImage="*\\OUTLOOK.EXE" OR ParentImage="*\\acrord32.exe" OR ParentImage="*\\acrobat.exe"
   OR ParentImage="*\\chrome.exe" OR ParentImage="*\\msedge.exe" OR ParentImage="*\\firefox.exe")
| eval ShellSpawned=if(match(lower(Image), "(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe)"), 1, 0)
| stats values(Image) as SpawnedProcesses, sum(ShellSpawned) as TotalShells,
        dc(host) as AffectedDevices, dc(User) as AffectedUsers, count as TotalEvents
  by ParentImage, span(_time, 1h)
| where TotalShells > 0
| sort - TotalEvents

Hunt for executable and script files being dropped to user-accessible directories. This surfaces payload staging activity — malware droppers, downloaders, and malicious scripts written to Downloads, Desktop, or Public folders. High AffectedDevices with the same initiating process indicates a delivery campaign in progress.

Hunting — KQL

kql

DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath has_any ("\\Downloads\\", "\\Desktop\\", "\\Users\\Public\\")
| where FileName endswith ".exe" or FileName endswith ".dll"
    or FileName endswith ".lnk" or FileName endswith ".vbs"
    or FileName endswith ".js" or FileName endswith ".hta"
    or FileName endswith ".bat" or FileName endswith ".ps1"
| summarize
    FilesDropped = count(),
    FileNames = make_set(FileName),
    Hashes = make_set(SHA256),
    AffectedDevices = dcount(DeviceName)
    by InitiatingProcessFileName, FolderPath
| where FilesDropped > 1 or AffectedDevices > 2
| sort by AffectedDevices desc, FilesDropped desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
  (TargetFilename="*\\Downloads\\*" OR TargetFilename="*\\Desktop\\*" OR TargetFilename="*\\Users\\Public\\*")
  (TargetFilename="*.exe" OR TargetFilename="*.dll" OR TargetFilename="*.lnk"
   OR TargetFilename="*.vbs" OR TargetFilename="*.js" OR TargetFilename="*.hta"
   OR TargetFilename="*.bat" OR TargetFilename="*.ps1")
| stats values(TargetFilename) as FileNames, values(Hashes) as Hashes,
        count as FilesDropped, dc(host) as AffectedDevices
  by Image
| where FilesDropped > 1 OR AffectedDevices > 2
| sort - AffectedDevices

Hunt for remote access tool executions trending across the environment, grouped by day. Scattered Spider and LAPSUS$ are documented to social-engineer employees into installing RATs. A spike across multiple devices in a short window — especially outside of change management windows — is a strong indicator of an active social engineering campaign. The ParentProcesses field reveals whether the RAT was launched from a browser (social engineering) or a management tool (legitimate IT deployment).

Hunting — KQL

kql

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("anydesk.exe", "teamviewer.exe", "screenconnect.exe",
    "connectwisecontrol.exe", "splashtopstreamer.exe", "ultraviewer.exe",
    "rustdesk.exe", "supremo.exe", "ammyy admin.exe", "radmin.exe",
    "atera_agent.exe", "level.exe", "netsupport.exe")
| summarize
    ExecutionCount = count(),
    AffectedDevices = dcount(DeviceName),
    AffectedUsers = dcount(AccountName),
    ParentProcesses = make_set(InitiatingProcessFileName),
    SampleCmdLines = make_set(ProcessCommandLine, 3)
    by FileName, bin(Timestamp, 1d)
| order by AffectedDevices desc, ExecutionCount desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\anydesk.exe" OR Image="*\\teamviewer.exe" OR Image="*\\screenconnect.exe"
   OR Image="*\\connectwisecontrol.exe" OR Image="*\\splashtopstreamer.exe"
   OR Image="*\\ultraviewer.exe" OR Image="*\\rustdesk.exe" OR Image="*\\supremo.exe"
   OR Image="*\\radmin.exe" OR Image="*\\netsupport.exe")
| stats count as ExecutionCount, dc(host) as AffectedDevices, dc(User) as AffectedUsers,
        values(ParentImage) as ParentProcesses, values(CommandLine) as SampleCmdLines
  by Image, span(_time, 1d)
| sort - AffectedDevices

Atomic Red Team Tests

Test 1 Malicious Office Document Macro Spawning cmd.exe

windows

Simulates a user opening a macro-enabled Word document that spawns cmd.exe — the most common Office-based user execution chain seen in phishing campaigns. Uses a VBScript invocation to emulate the macro execution pattern without requiring an actual Word document. The cmd.exe spawned from wscript.exe closely mirrors the process tree created by a malicious VBA macro in WINWORD.EXE.

Command

powershell

echo Set oShell = CreateObject("WScript.Shell") > %TEMP%\df00tech_test.vbs && echo oShell.Run "cmd.exe /c whoami > %TEMP%\df00tech_result.txt" >> %TEMP%\df00tech_test.vbs && wscript.exe %TEMP%\df00tech_test.vbs

Cleanup

powershell

del %TEMP%\df00tech_test.vbs %TEMP%\df00tech_result.txt 2>nul

Expected Telemetry

Sysmon Event ID 1: wscript.exe Process Create with CommandLine containing df00tech_test.vbs. Second Sysmon Event ID 1: cmd.exe Process Create with ParentImage=wscript.exe and CommandLine containing whoami. Sysmon Event ID 11: File Create for df00tech_result.txt in %TEMP%.

Expected Detection

The SPL/KQL detection triggers on wscript.exe (a ShellInterpreter) being spawned by wscript.exe, and on cmd.exe with ParentImage=wscript.exe. In the Office spawn branch, substitute wscript.exe as the initiating parent — the pattern mirrors WINWORD.EXE → WScript.Shell → cmd.exe.

Test 2 Simulated ClickFix / Clipboard Paste Execution (Lumma Stealer Pattern)

windows

Simulates the ClickFix / ClearFake clipboard paste execution technique used by Lumma Stealer and other campaigns. A fake CAPTCHA page instructs the user to press Win+R, paste clipboard contents, and press Enter. This test loads a benign Base64-encoded PowerShell command into the clipboard and executes it via the Run dialog simulation — spawning powershell.exe from explorer.exe with an encoded command, exactly as the malware does.

Command

powershell

powershell.exe -Command "$encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes('Write-Output ClickFix-Test-df00tech')); Set-Clipboard -Value (\"powershell -enc $encoded\"); Start-Process powershell.exe -ArgumentList \"-enc $encoded\""

Cleanup

powershell

Set-Clipboard -Value '' 2>$null

Expected Telemetry

Sysmon Event ID 1: powershell.exe Process Create with CommandLine containing '-enc' and a Base64 string. ParentImage will be powershell.exe (the launcher). PowerShell ScriptBlock Log Event ID 4104 will show decoded content 'Write-Output ClickFix-Test-df00tech'. In a real ClickFix scenario, the parent would be explorer.exe (Run dialog) spawning powershell.exe with -enc.

Expected Detection

KQL EncodedCmd pattern fires. SPL EncodedCmd=1. The T1059.001 PowerShell detection will also fire simultaneously, demonstrating how T1204 (user execution vector) chains into T1059.001 (execution method).

Test 3 Remote Access Tool Execution Simulating Social Engineering

windows

Simulates a user downloading and executing a legitimate remote access tool after being social-engineered by a fake IT helpdesk (Scattered Spider TTP). Uses curl to download the AnyDesk installer to the Downloads folder and then launches it via explorer shell simulation. This test only downloads the legitimate installer — it does not install or configure it. This validates detection of RAT binaries appearing in Downloads and being launched from user-facing parent processes.

Command

powershell

curl -L -o "%USERPROFILE%\Downloads\AnyDesk.exe" https://download.anydesk.com/AnyDesk.exe && echo Download complete - file at %USERPROFILE%\Downloads\AnyDesk.exe && dir "%USERPROFILE%\Downloads\AnyDesk.exe"

Cleanup

powershell

del "%USERPROFILE%\Downloads\AnyDesk.exe" 2>nul

Expected Telemetry

Sysmon Event ID 11: File Create for AnyDesk.exe in %USERPROFILE%\Downloads\ with initiating process curl.exe. Zone.Identifier ADS written to AnyDesk.exe confirming ZoneId=3 (Internet). If the binary is then executed (in a controlled lab), Sysmon Event ID 1: AnyDesk.exe Process Create with ParentImage=explorer.exe and FolderPath containing \Downloads\.

Expected Detection

File drop detected via hunting query 2 (executable in user-accessible directory). If executed, triggers IsRATExecution=true and IsUserDirExec=true in both KQL and SPL detections. DetectionCategory = 'Remote Access Tool Execution (Possible Social Engineering)'.

Test 4 Malicious LNK File Execution from Removable Media (Raspberry Robin Pattern)

windows

Simulates the Raspberry Robin technique where a user executes a malicious LNK shortcut from a USB drive or downloaded archive. Creates an LNK file that spawns cmd.exe with a benign payload, mirroring the process tree created when a user double-clicks a malicious shortcut. Raspberry Robin distributed malware exclusively through LNK files that users clicked, relying entirely on user interaction.

Command

powershell

powershell.exe -Command "$ws = New-Object -COM WScript.Shell; $shortcut = $ws.CreateShortcut('%TEMP%\df00tech_lnk_test.lnk'); $shortcut.TargetPath = 'cmd.exe'; $shortcut.Arguments = '/c echo LNK-Execution-Test-df00tech > %TEMP%\df00tech_lnk_result.txt'; $shortcut.Save(); Invoke-Item '%TEMP%\df00tech_lnk_test.lnk'"

Cleanup

powershell

del "%TEMP%\df00tech_lnk_test.lnk" "%TEMP%\df00tech_lnk_result.txt" 2>nul

Expected Telemetry

Sysmon Event ID 11: File Create for df00tech_lnk_test.lnk in %TEMP%. Sysmon Event ID 1: cmd.exe Process Create with ParentImage=explorer.exe (shell invocation) and CommandLine containing 'LNK-Execution-Test-df00tech'. The FolderPath for cmd.exe will be %TEMP%, which matches the user-writable path detection branch.

Expected Detection

IsUserDirExec=true triggers when cmd.exe or the child process is launched from %TEMP% via explorer.exe. The LNK file creation in %TEMP% is flagged by hunting query 2 (executable/script file in user-writable directory). In a removable media scenario, the FolderPath would match a drive letter outside of standard install paths.

Related Detections

Tactic Hub

TA0002Execution

What is T1204 User Execution?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for T1204

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hub

Sub-techniques (5)

Related Techniques

Same Tactic: Execution

Popular Detections

Get new detections in your inbox