Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
1
Platforms
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects the legitimate Windows utility 'attrib.exe' initiating outbound network connections to common SMTP ports. This behavior is highly anomalous as attrib.exe is used to modify file attributes and should not be making network connections. The Mispadu banking trojan is known to inject its code into attrib.exe and use it to self-propagate by sending phishing emails.
