Hide Navigation Hide TOC

Suspicious Microsoft OneNote Child Process (c27515df-97a9-4162-8a60-dc0eeb51b775)

Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Phishing - T1566 (a62a8db3-f23a-4d8f-afd6-9dbc77e7813b)	Attack Pattern	Suspicious Microsoft OneNote Child Process (c27515df-97a9-4162-8a60-dc0eeb51b775)	Sigma-Rules	1
Spearphishing Attachment - T1566.001 (2e34237d-8574-43f6-aace-ae2915de8597)	Attack Pattern	Suspicious Microsoft OneNote Child Process (c27515df-97a9-4162-8a60-dc0eeb51b775)	Sigma-Rules	1
Phishing - T1566 (a62a8db3-f23a-4d8f-afd6-9dbc77e7813b)	Attack Pattern	Spearphishing Attachment - T1566.001 (2e34237d-8574-43f6-aace-ae2915de8597)	Attack Pattern	2