CmdID

CmdID / Techniques

T1203 Exploitation for Client Execution

Adversaries may exploit software vulnerabilities in client applications to execute code. MITRE ATT&CK

18 Sigma rules T1203 on attack.mitre.org

Sigma rules tagged with it

process creation, the highest levels first

criticalExploit for CVE-2017-8759Florian Roth (Nextron Systems) · Windows

highCVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child ProcessNasreddine Bencherchali (Nextron Systems), Andreas Braathen (mnemonic.io) · Windows

highExploitation Activity of CVE-2025-59287 - WSUS Suspicious Child ProcessHuntress Labs, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows

highOMIGOD SCX RunAsProvider ExecuteScriptRoberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC · Linux

highOMIGOD SCX RunAsProvider ExecuteShellCommandRoberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC · Linux

highPotential CVE-2021-26857 Exploitation AttemptBhabesh Raj · Windows

highShai-Hulud Malicious Bun ExecutionSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

highShai-Hulud Malicious Bun Execution - LinuxSwachchhanda Shrawan Poudel (Nextron Systems) · Linux

highSuspicious ArcSOC.exe Child ProcessMicah Babinski · Windows

highSuspicious Download and Execute Pattern via Curl/WgetAayush Gupta · Linux

highSuspicious HWP Sub ProcessesFlorian Roth (Nextron Systems) · Windows

highSuspicious Invocation of Shell via RsyncFlorian Roth · Linux

highSuspicious Spool Service Child ProcessJustin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule) · Windows

mediumExploit for CVE-2017-0261Florian Roth (Nextron Systems) · Windows

mediumJava Running with Remote DebuggingFlorian Roth (Nextron Systems) · Windows

mediumPotentially Suspicious Child Process of KeyScrambler.exeSwachchhanda Shrawan Poudel · Windows

mediumPotentially Suspicious Child Process Of WinRAR.EXENasreddine Bencherchali (Nextron Systems) · Windows

mediumSuspicious Browser Child Process - MacOSSohan G (D4rkCiph3r) · macOS