MITRE ATT&CK technique
Fallback Channels detection rulesT1008
Fallback Channels (T1008) is a MITRE ATT&CK technique in the Command and Control tactic. This page lists the 4 community-maintained Sigma detection rules in the library mapped to T1008 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows.
Top products
Tactic
Outlook Macro Execution Without Warning Setting Enabled
highDetects the modification of Outlook security setting to allow unprompted execution of macros.
windows · registry_set
Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting
highDetects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module
windows · registry_set
Suspicious Outlook Macro Created
highDetects the creation of a macro file for Outlook.
windows · file_event
New Outlook Macro Created
mediumDetects the creation of a macro file for Outlook.
windows · file_event