car.2013-05-002 | Detection.FYI

Suspicious Binary In User Directory Spawned From Office Application

Aug 12, 2024 · attack.execution attack.t1204.002 attack.g0046 car.2013-05-002 ·
Share on:

Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio)

Read More
Suspicious Process Start Locations

Aug 12, 2024 · attack.defense-evasion attack.t1036 car.2013-05-002 ·
Share on:

Detects suspicious process run from unusual locations

Read More