attack.t1566.002

Suspicious Execution via macOS Script Editor

Apr 28, 2026 · attack.defense-impairment attack.t1566 attack.t1566.002 attack.initial-access attack.t1059 attack.t1059.002 attack.t1204 attack.t1204.001 attack.execution attack.persistence attack.t1553 ·

Share on:

Detects when the macOS Script Editor utility spawns an unusual child process.

Suspicious Email Delivered In Microsoft 365

Apr 27, 2026 · attack.initial-access attack.t1566.001 attack.t1566.002 ·

Share on:

Detects instances where an email, identified as malicious or suspicious by the Microsoft Defender for Office 365 (formerly ATP) engine, was delivered to a user's Inbox or Junk folder. It might indicate that a potential threat, such as a spearphishing attachment or links, has bypassed initial blocking mechanisms and reached an end-user, requiring further investigation and potential remediation.

Potential Malicious Usage of CloudTrail System Manager

Dec 9, 2025 · attack.privilege-escalation attack.initial-access attack.t1566 attack.t1566.002 ·

Share on:

Detect when System Manager successfully executes commands against an instance.