Skip to content

Hide Navigation Hide TOC

Suspicious Download from Office Domain (00d49ed5-4491-4271-a8db-650a4ef6f8c1)

Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents

Cluster A Galaxy A Cluster B Galaxy B Level
Stage Capabilities - T1608 (84771bc3-f6a0-403e-b144-01af70e5fda0) Attack Pattern Suspicious Download from Office Domain (00d49ed5-4491-4271-a8db-650a4ef6f8c1) Sigma-Rules 1
Ingress Tool Transfer - T1105 (e6919abc-99f9-4c6c-95a5-14761e7b2add) Attack Pattern Suspicious Download from Office Domain (00d49ed5-4491-4271-a8db-650a4ef6f8c1) Sigma-Rules 1