Arbitrary File Download Via MSPUB.EXE
Detects the usage of Microsoft Publisher (MSPUB.exe) to download arbitrary files from remote locations (FTP, HTTP, HTTPS). This technique can be abused by adversaries to bypass application control and execute malicious content.
Sigma
