PDF Viewer Spawning Network Tool (T1105)
Correlates a PDF reader (Adobe, Foxit) executing a native network utility (cURL, certutil) to fetch a secondary payload, indicative of malicious PDF links or exploits.
Microsoft Sentinel (KQL)
Correlates a PDF reader (Adobe, Foxit) executing a native network utility (cURL, certutil) to fetch a secondary payload, indicative of malicious PDF links or exploits.
Already have an account?