Detection Strategies DET0478 — User Execution – multi-surface behavior chain (documents/links → helper/unpacker → LOLBIN/child → egress)

DET0478

User Execution – multi-surface behavior chain (documents/links → helper/unpacker → LOLBIN/child → egress)

5 analytic(s) · 1 technique(s) detected

Analytics

AN1314 Analytic 1314

Windows

Cause→effect chain: (1) User-facing app (Office/PDF/archiver/browser) records an open/click or abnormal event, then (2) a downloaded file is created in a user-writable path and/or decompressed, (3) the parent user app spawns a living-off-the-land binary (e.g., powershell/cmd/mshta/rundll32/msiexec/wscript/expand/zip) or installer, and (4) immediate outbound HTTP(S)/DNS/SMB from the same lineage.

WinEventLog:Application EventCode=1000 WinEventLog:Sysmon EventCode=11 WinEventLog:Security EventCode=4688 WinEventLog:Sysmon EventCode=3, 22

[TimeWindow] Correlation window (e.g., 15 minutes) from document open to child/egress.

[HighRiskParents] Apps that should rarely spawn OS utilities (winword.exe, excel.exe, powerpnt.exe, acrord32.exe, chrome/msedge/firefox, 7zFM.exe, winrar.exe, explorer.exe).

[HighRiskChildren] LOLBIN list: powershell.exe, cmd.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, msiexec.exe, curl.exe, bitsadmin.exe, pcalua.exe, expand.exe, tar.exe.

[UserPaths] Writable paths to watch: %USERPROFILE%\Downloads, %TEMP%, %APPDATA%\*, OneDrive/Teams cache, Office startup folders.

[EgressAllowList] Corporate update/CDN domains and proxy egress CIDRs to suppress benign updater traffic.

AN1315 Analytic 1315

Linux

Cause→effect chain: (1) User app/browser/archiver logs an open/click or abnormal exit, (2) new executable/script/archive extracted into $HOME/Downloads, /tmp, or ~/.cache, (3) parent app spawns shell/interpreter (bash/sh/python/node/curl/wget) or desktop file, and (4) new outbound connection(s) from the child lineage.

linux:syslog opened document|clicked link|segfault|abnormal termination|sandbox auditd:SYSCALL open auditd:SYSCALL creat auditd:SYSCALL rename,chmod auditd:SYSCALL execve NSM:Flow new outbound connection from browser/office lineage

[TimeWindow] 5–20 minute correlation window.

[UserPaths] $HOME/Downloads, /tmp, ~/.cache, ~/.config/autostart, ~/.local/share.

[HighRiskChildren] bash, sh, zsh, python*, perl, node, curl, wget, xdg-open, kde-open, gio open, unzip/tar extraction leading to exec.

[PkgUpdaters] Allow-list snap/flatpak/packagekit/apt workers to reduce false positives.

AN1316 Analytic 1316

macOS

Cause→effect chain: (1) unified logs show application open/click or crash for Safari/Chrome/Office/Preview/archiver, (2) file write/extraction into ~/Downloads, /private/var/folders/* or ~/Library, (3) parent app spawns osascript/bash/zsh/curl/python or opens a quarantined app with Gatekeeper prompts, (4) network egress from child.

macos:unifiedlog opened document|clicked link|EXC_BAD_ACCESS|abort|LSQuarantine fs:fileevents create/write/rename in user-writable paths macos:osquery exec NSM:Flow new outbound connection from exploited lineage

[TimeWindow] 10–30 minute correlation window.

[HighRiskChildren] osascript, bash, zsh, curl, python, open -a Terminal, installer, tccutil misuse.

[QuarantineSignals] Flag new apps lacking com.apple.quarantine or with quarantine='0081' (downloaded then auto-opened).

AN1317 Analytic 1317

Containers

Cause→effect chain in CI/dev desktops: (1) user triggers container run/pull after opening a doc/link/script, (2) newly created image/container uses unexpected external registry or entrypoint, (3) container starts and immediately egresses to suspicious destinations.

docker:events created,started: new container from untrusted registry or unexpected entrypoint docker:events start NSM:Flow container egress to unknown IPs/domains

[TrustedRegistries] Approved registries/namespaces.

[AllowedEntrypoints] Expected CMD/ENTRYPOINT for known images.

[TimeWindow] Correlate user action → docker/podman run within 10 minutes.

AN1318 Analytic 1318

IaaS

Cause→effect chain in cloud consoles: (1) user clicks link then invokes instance/image creation via API, (2) instance/image originates from external AMI or unknown image, (3) instance immediately egresses or retrieves payloads.

AWS:CloudTrail RunInstances,CreateImage AWS:CloudTrail StartInstances gcp:vpcflow first 5m egress to unknown ASNs

[ApprovedImages] AMI/image allow-list with owners.

[UserContext] High-risk identities (federated, external IdP).

[TimeWindow] 5–30 minutes from console/API action to network egress.

Detected Techniques

Execution (1)

T1204 User Execution

Details

MITRE ID: DET0478
STIX ID: x-mitre-detection-strategy--70c9f174-2e96-4086-b59c-d2358e434f8e
Analytics: 5
Techniques Detected: 1
By Tactic