Browse all 67 CVEs and 239 stream-level YARA rules included in the MalwareTracker API and QuickSand Pro Threat Feed.
| Rule Name | Description | CVE | MITRE ATT&CK | Module |
|---|---|---|---|---|
warning_exec_ocx_object |
OLE application command | — | T1204.002 | EXPLOITS |
warning_scriptbridge |
ScriptBridge may load remote exploit | — | T1204.002 | EXPLOITS |
exploit_cve_2006_2492 |
smarttag overflow CVE-2006-2492 | CVE-2006-2492 | T1203 T1204.002 | EXPLOITS |
exploit_cve_2009_3129 |
excel buffer overflow CVE-2009-3129 | CVE-2009-3129 | T1203 T1204.002 | EXPLOITS |
warning_embedded_flash |
Embedded Flash data | — | T1204.002 | EXPLOITS |
exploit_cve_2011_0609 |
Flash exploit CVE-2011-0609 | CVE-2011-0609 | T1203 T1204.002 | EXPLOITS |
exploit_cve_2011_0611 |
Flash exploit CVE-2011-061 | CVE-2011-0611 | T1203 T1204.002 | EXPLOITS |
exploit_cve_2012_0754 |
Flash exploit malformed mp4 CVE-2012-0754 | CVE-2012-0754 | T1203 T1204.002 | EXPLOITS |
exploit_cve_2010_3333 |
RTF stack overflow pFragments CVE-2010-3333 | CVE-2010-3333 | T1203 T1204.002 | EXPLOITS |
warning_rtf_embedded_file |
RTF embedded file package | — | T1027 | EXPLOITS |
exploit_MS12_060_tomato_garden |
Office exploit MSCOMCTL.OCX Toolbar MS12-060 Tomato Garden campaign | — | T1203 T1204.002 | EXPLOITS |
warning_office_encrypted_doc |
office encrypted document | — | T1027 | EXPLOITS |
warning_office_encrypted_unsupported_xor |
office obfuscated document 2003 XOR with VelvetSweatshop | — | T1027 | EXPLOITS |
exploit_cve_2012_1535 |
Flash exploit CVE-2012-1535 | CVE-2012-1535 | T1203 T1204.002 | EXPLOITS |
exploit_cve_2013_0634 |
Flash exploit CVE-2013-0634 memory corruption | CVE-2013-0634 | T1203 T1204.002 | EXPLOITS |
exploit_cve_2012_5054 |
Flash exploit CVE-2012-5054 Matrix3D | CVE-2012-5054 | T1203 T1204.002 | EXPLOITS |
exploit_cve_2012_1856 |
office embedded Flash in MSO file | CVE-2012-1856 | T1204.002 | EXPLOITS |
exploit_cve_2012_0158 |
Office exploit MSCOMCTL.OCX RCE CVE-2012-0158 | CVE-2012-0158 | T1203 T1204.002 | EXPLOITS |
warning_activex_exec |
Office exploit TIFF CVE-2013-3906 | CVE-2013-3906 | T1203 T1204.002 | EXPLOITS |
warning_package_manager_embedded |
Visual Basic macro | — | T1059.005 | EXPLOITS |
warning_js_embed |
Embedded js | — | T1059.007 | EXPLOITS |
warning_vbs_embed |
Embedded vbs | — | T1059.005 | EXPLOITS |
exploit_activex_execute_shell |
Visual Basic execute shell | — | T1059.003 T1059.005 | EXPLOITS |
warning_vba_createobject |
Visual Basic COM object instantiation or automation | — | T1059.005 | EXPLOITS |
warning_vb_autoopen |
Visual Basic macro | — | T1059.005 | EXPLOITS |
warning_vb_fileio |
Visual Basic file io | — | T1059.005 | EXPLOITS |
exploit_cve_2014_1761 |
RTF memory corruption listoverridecount CVE-2012-2539 CVE-2014-1761 | CVE-2012-2539 CVE-2014-1761 | T1203 T1204.002 | EXPLOITS |
exploit_cve_2014_4114 |
Office package manager executes .inf files CVE-2014-4114, CVE-2014-6352 | CVE-2014-4114 CVE-2014-6352 | T1203 T1204.002 | EXPLOITS |
exploit_cve_2015_0097 |
Microsoft Word Local Zone Remote Code Execution Vulnerability CVE-2015-0097 | CVE-2015-0097 | T1203 T1204.002 | EXPLOITS |
exploit_cve_2015_1770 |
office encrypted dataspace | CVE-2015-1770 | T1027 | EXPLOITS |
warning_flash_obfuscation |
Flash exec from string | — | T1027 | EXPLOITS |
warning_openxml_remote_smb |
External file inclusion may leak smb credentials | — | T1187 | EXPLOITS |
warning_SAXXMLReader |
Msxml2.SAXXMLReader class used in exploit obfuscation | — | T1027 | EXPLOITS |
exploit_cve_2017_8759 |
OLE WSDL Parser Code Injection in PrintClientProxy CVE-2017-8759 | CVE-2017-8759 | T1203 T1204.002 | EXPLOITS |
warning_js_inzip |
Embedded js | — | T1059.007 | EXPLOITS |
warning_excel_dde_exec |
Embedded shell command | — | T1059.003 | EXPLOITS |
warning_excel_dde_auto |
if present overrides warning message | — | T1059.003 | EXPLOITS |
exploit_cve_2017_11826 |
update RTF object may load malicious content | CVE-2017-11826 | T1027 | EXPLOITS |
exploit_CVE_2018_0798 |
URL Moniker MSHTML Risky Remote Content | CVE-2018-0798 | T1059.007 | EXPLOITS |
warning_openxml_remote_script |
External script inclusion | — | T1059.007 | EXPLOITS |
warning_openoffice_remote_script |
External script inclusion | — | T1059.007 | EXPLOITS |
warning_ole_remote_template |
External template inclusion | — | T1221 | EXPLOITS |
warning_rtf_remote_template |
External template inclusion | — | T1221 | EXPLOITS |
warning_rtf_unicode_template |
Obfuscated RTF template | — | T1221 | EXPLOITS |
warning_openxml_remote_template |
External template inclusion | — | T1221 | EXPLOITS |
warning_hwp_active_content |
JavaScript in HWP Document | — | T1059.007 | EXPLOITS |
warning_postscript_exec |
Postscript exec | — | T1059 | EXPLOITS |
warning_postscript_xor |
Postscript xor could be used for obfuscation | — | T1027 | EXPLOITS |
warning_postscript_nopsled |
Postscript buffer overflow | — | T1027 | EXPLOITS |
exploit_cve_2017_11774 |
CVE-2017-11774 Outlook attack | CVE-2017-11774 | T1137 | EXPLOITS |
warning_possible_guardrail |
accessing userdnsdomain | — | T1480 | EXPLOITS |
warning_possible_vbapurging |
macro source may have been removed | — | T1564.007 | EXPLOITS |
warning_possible_vbapurged |
macro source removed with tool | — | T1564.007 | EXPLOITS |
warning_excel_macro |
Excel 4.0 macro | — | T1059.005 | EXPLOITS |
warning_excel_exec |
Excel 4.0 macro execute | — | T1059.005 | EXPLOITS |
warning_excel_register |
Excel 4.0 macro register dll | — | T1059.005 | EXPLOITS |
warning_excel_formula_mod |
Excel 4.0 macro register dll | — | T1059.005 | EXPLOITS |
warning_excel_auto_open |
Excel 4.0 macro Auto_Open | — | T1059.005 | EXPLOITS |
warning_excel_download |
Excel 4.0 macro Auto_Open | — | T1204.002 | EXPLOITS |
warning_macrosheet_ip |
IP Address in a Macrosheet | — | T1204.002 | EXPLOITS |
warning_excel_run |
Excel 4.0 macro execute | — | T1059.005 | EXPLOITS |
warning_excel_sheet_formula |
Excel 4.0 macro execute | — | T1059.005 | EXPLOITS |
exploit_cve_2021_40444 |
CVE-2021-40444 external mhtml inclusion | CVE-2021-40444 | T1203 T1204.002 | EXPLOITS |
warning_suspicious_mhtml_http |
mhtml link or inclusion | — | — | EXPLOITS |
warning_suspicious_js_onenote |
OneNote with JavaScript | — | T1059.007 | EXPLOITS |
warning_suspicious_vba_onenote |
OneNote with VBA Scripting | — | T1059.005 | EXPLOITS |
warning_suspicious_afchunk |
Alternative Chunk | — | T1202 | EXPLOITS |
warning_suspicious_objautlink |
RTF Linked Object | — | T1202 | EXPLOITS |
exploit_cve_2022_30190 |
Follina external OLE Object or MSDT/search-ms URI handler | CVE-2022-30190 | T1203 | EXPLOITS |
exploit_cve_2024_21413 |
Moniker Link bypass CVE-2024-21413 | CVE-2024-21413 | T1203 T1204.002 | EXPLOITS |
exploit_cve_2023_23397 |
Outlook NTLM Leak via PidLidReminderFileParameter CVE-2023-23397 | CVE-2023-23397 | T1187 T1203 | EXPLOITS |
warning_unc_path_inclusion |
External UNC share reference in document relationship or link | — | T1187 | EXPLOITS |
exploit_cve_2023_36884 |
Suspicious AltChunk with active MHT/OLE/Script content CVE-2023-36884 | CVE-2023-36884 | T1203 T1204.002 | EXPLOITS |
exploit_cve_2026_21509 |
security feature bypass CVE-2026-21509 | CVE-2026-21509 | T1203 T1204.002 | EXPLOITS |
warning_remote_stylesheet |
External stylesheet inclusion | — | T1221 | EXPLOITS |
exploit_cve_2023_21716_rtf_fonttbl |
Word RTF fonttbl heap corruption CVE-2023-21716 | CVE-2023-21716 | T1203 | EXPLOITS |
warning_vba_powershell_cradle |
PowerShell download cradle or encoded command execution | — | T1059.001 | EXPLOITS |
warning_vba_lolbin_execution |
Living-off-the-Land binary (LOLBin) execution in document | — | T1218 | EXPLOITS |
warning_vba_wmi_execution |
WMI Win32_Process or ScheduledJob execution | — | T1047 | EXPLOITS |
exploit_vba_shellcode_injection |
VBA Win32 API shellcode injection via VirtualAlloc/CreateThread/Callbacks | — | T1055 | EXPLOITS |
warning_excel_sandbox_evasion |
Excel 4.0 XLM macro environment check / sandbox evasion | — | T1497.001 | EXPLOITS |
warning_excel_char_obfuscation |
Excel 4.0 XLM macro CHAR() string obfuscation | — | T1027 | EXPLOITS |
exploit_onenote_embedded_payload |
OneNote (.one) document with embedded executable or script payload | — | T1204.002 | EXPLOITS |
warning_webdav_smb_coercion |
WebDAV/SMB authentication coercion path (@SSL / DavWWWRoot) | — | T1187 | EXPLOITS |
exploit_cve_2025_21298_ole_pres_rce |
Windows OLE UtOlePresStmToContentsStm RCE in RTF objdata (CVE-2025-21298) | CVE-2025-21298 | T1203 | EXPLOITS |
exploit_cve_2026_21514_ole_lnk_bypass |
Word OLE Shell Link CONTENTS security feature bypass (CVE-2026-21514) | CVE-2026-21514 | T1203 T1204.002 | EXPLOITS |
exploit_cve_2024_43451_url_ntlm_spoof |
InternetShortcut (.url) NTLM hash disclosure / SmartScreen bypass (CVE-2024-43451 / CVE-2023-36025) | CVE-2023-36025 CVE-2024-43451 | T1187 T1204.002 | EXPLOITS |
exploit_cve_2023_38831_archive_spoof |
WinRAR / archive trailing-space filename spoofing RCE (CVE-2023-38831) | CVE-2023-38831 | T1036.007 T1203 | EXPLOITS |
exploit_cve_2018_8414_settingcontent_ms |
Windows Shell SettingContent-ms DeepLink command execution (CVE-2018-8414) | CVE-2018-8414 | T1059 T1204.002 | EXPLOITS |
exploit_cve_2018_8174_vbscript_uaf |
VBScript engine memory corruption / UAF exploit (CVE-2018-8174 / CVE-2019-0752) | CVE-2018-8174 CVE-2019-0752 | T1059.005 T1203 | EXPLOITS |
exploit_swf_actionscript_heap_spray |
Shockwave Flash ActionScript 3 ByteArray memory corruption / heap spray exploit | — | T1203 | EXPLOITS |
exploit_cve_2025_8088_rar_ads_traversal |
WinRAR NTFS Alternate Data Stream (ADS) path traversal RCE (CVE-2025-8088) | CVE-2025-8088 | T1203 T1564.004 | EXPLOITS |
exploit_cve_2025_24071_library_ms_ntlm |
Windows File Explorer .library-ms / .searchConnector-ms remote UNC NTLM hash disclosure (CVE-2025-24071) | CVE-2025-24071 | T1187 T1203 | EXPLOITS |
exploit_cve_2025_24054_lnk_ntlm_leak |
Windows Shell Link (.lnk) remote UNC NTLM hash disclosure / coercion (CVE-2025-24054) | CVE-2025-24054 | T1187 T1204.002 | EXPLOITS |
exploit_dotnet_binaryformatter_deserialization |
.NET BinaryFormatter deserialization gadget embedded in Office/ActiveX stream | — | T1203 | EXPLOITS |
exploit_cve_2025_59689_archive_cmd_injection |
Archive entry filename shell command injection (CVE-2025-59689) | CVE-2025-59689 | T1059 T1203 | EXPLOITS |
shellcode_hash__CloseHandle |
shellcode.hash CloseHandle | — | T1106 | |
shellcode_hash__CreateFileA |
shellcode.hash CreateFileA | — | T1106 | |
shellcode_hash__CreateProcessA |
shellcode.hash CreateProcessA | — | T1106 | |
shellcode_hash__DeleteFileA |
shellcode.hash DeleteFileA | — | T1106 | |
shellcode_hash__ExitProcess |
shellcode.hash ExitProcess | — | T1106 | |
shellcode_hash__ExitThread |
shellcode.hash ExitThread | — | T1106 | |
shellcode_hash__GetProcAddress |
shellcode.hash GetProcAddress | — | T1129 | |
shellcode_hash__GetSystemDirectoryA |
shellcode.hash GetSystemDirectoryA | — | T1106 | |
shellcode_hash___hwrite |
shellcode.hash _hwrite | — | T1106 | |
shellcode_hash___lclose |
shellcode.hash _lclose | — | T1106 | |
shellcode_hash___lcreat |
shellcode.hash _lcreat | — | T1106 | |
shellcode_hash__LoadLibraryA |
shellcode.hash LoadLibraryA | — | T1129 | |
shellcode_hash___lwrite |
shellcode.hash _lwrite | — | T1106 | |
shellcode_hash__SetUnhandledExceptionFilter |
shellcode.hash SetUnhandledExceptionFilter | — | T1106 | |
shellcode_hash__WaitForSingleObject |
shellcode.hash WaitForSingleObject | — | T1106 | |
shellcode_hash__WinExec |
shellcode.hash WinExec | — | T1059.003 | |
shellcode_hash__WriteFile |
shellcode.hash WriteFile | — | T1059 | |
shellcode_hash__accept |
shellcode.hash accept | — | T1106 | |
shellcode_hash__bind |
shellcode.hash bind | — | T1106 | |
shellcode_hash__closesocket |
shellcode.hash closesocket | — | T1106 | |
shellcode_hash__connect |
shellcode.hash connect | — | T1106 | |
shellcode_hash__listen |
shellcode.hash listen | — | T1106 | |
shellcode_hash__recv |
shellcode.hash recv | — | T1106 | |
shellcode_hash__send |
shellcode.hash send | — | T1106 | |
shellcode_hash__socket |
shellcode.hash socket | — | T1106 | |
shellcode_hash__WSASocketA |
shellcode.hash WSASocketA | — | T1106 | |
shellcode_hash__WSAStartup |
shellcode.hash WSAStartup | — | T1106 | |
shellcode_hash__URLDownloadToFileA |
shellcode.hash URLDownloadToFileA | — | T1106 | |
suspicious_shellcode_NOP_Sled |
suspicious.shellcode NOP Sled | — | T1106 | |
suspicious_obfuscation_using_unescape |
suspicious.obfuscation using unescape | — | T1027 | |
suspicious_obfuscation_using_charCodeAt |
suspicious.obfuscation using charCodeAt | — | T1027 | |
suspicious_string_nopblock |
suspicious.string nopblock | — | T1027 | |
suspicious_obfuscation_using_eval |
suspicious.obfuscation using eval | — | T1027 | |
suspicious_javascript_object |
suspicious.javascript object | — | T1027 T1059.007 | |
suspicious_javascript_in_XFA_block |
suspicious.javascript in XFA block | — | T1027 T1059.007 | |
suspicious_pdf_embedded_PDF_file |
suspicious.pdf embedded PDF file | — | T1204.002 | |
suspicious_obfuscation_toString |
suspicious.obfuscation toString | — | T1027 | |
suspicious_obfuscation_using_substr |
suspicious.obfuscation using substr | — | T1027 | |
suspicious_obfuscation_using_String_replace |
suspicious.obfuscation using String.replace | — | T1027 | |
suspicious_obfuscation_using_String_fromCharCode |
suspicious.obfuscation using String.fromCharCode | — | T1027 | |
suspicious_obfuscation_using_substring |
suspicious.obfuscation using substring | — | T1027 | |
suspicious_obfuscation_using_util_byteToChar |
suspicious.obfuscation using util.byteToChar | — | T1027 | |
suspicious_string_Shellcode_NOP_sled |
suspicious.string Shellcode NOP sled | — | T1027 | |
suspicious_string_heap_spray_shellcode |
suspicious.string heap spray shellcode | — | T1027 | |
suspicious_string_shellcode |
suspicious.string shellcode | — | T1027 | |
suspicious_string__Run_Sploit_ |
suspicious.string -Run_Sploit- | — | T1027 | |
suspicious_string__HeapSpray_ |
suspicious.string -HeapSpray- | — | T1027 | |
suspicious_flash_writeMultiByte |
suspicious.flash writeMultiByte | — | T1027 | |
suspicious_flash_addFrameScript |
suspicious.flash addFrameScript | — | T1027 | |
suspicious_flash_Adobe_Shockwave_Flash_in_a_PDF_define_obj_type |
suspicious.flash Adobe Shockwave Flash in a PDF define obj type | — | — | |
suspicious_flash_obfuscated_name |
suspicious.flash obfuscated name | — | T1027 | |
pdf_exploit_FlateDecode_Stream_Predictor_02_Integer_Overflow_CVE_2009_3459 |
pdf.exploit FlateDecode Stream Predictor 02 Integer Overflow CVE-2009-3459 | CVE-2009-3459 | T1203 T1204.002 | |
pdf_exploit_colors_number_is_high_CVE_2009_3459 |
pdf.exploit colors number is high CVE-2009-3459 | CVE-2009-3459 | T1203 T1204.002 | |
pdf_exploit_URI_directory_traversal |
pdf.exploit URI directory traversal | — | T1203 T1204.002 | |
pdf_exploit_URI_directory_traversal_system32 |
pdf.exploit URI directory traversal system32 | — | T1203 T1204.002 | |
pdf_exploit_execute_EXE_file |
pdf.exploit execute EXE file | — | T1203 T1204.002 | |
pdf_warning_openaction |
pdf.information OpenAction | — | T1203 T1204.002 | |
pdf_suspicious_openaction_active |
pdf.warning OpenAction with active execution trigger | — | T1203 T1204.002 | |
pdf_exploit_access_system32_directory |
pdf.exploit access system32 directory | — | T1203 T1204.002 | |
pdf_warning_remote_action |
pdf.information action uri link | — | T1566.002 | |
pdf_exploit_execute_action_command |
pdf.exploit execute action command | — | T1203 T1204.002 | |
pdf_exploit_printSeps_memory_heap_corruption_CVE_2010_4091 |
pdf.exploit printSeps memory heap corruption CVE-2010-4091 | CVE-2010-4091 | T1203 T1204.002 | |
suspicious_obfuscation_jjencoded_javascript |
suspicious.obfuscation jjencoded javascript | — | T1059.007 | |
suspicious_obfuscation_getAnnots_access_blocks |
suspicious.obfuscation getAnnots access blocks | — | T1059.007 | |
suspicious_obfuscation_info_Trailer_to_access_blocks |
suspicious.obfuscation info.Trailer to access blocks | — | T1059.007 | |
suspicious_obfuscation_using_app_setTimeOut_to_eval_code |
suspicious.obfuscation using app.setTimeOut to eval code | — | T1059.007 | |
suspicious_string__shellcode_ |
suspicious.string -shellcode- | — | T1027 T1059.007 | |
pdf_exploit_Collab_collectEmailInfo_CVE_2008_0655 |
pdf.exploit Collab.collectEmailInfo CVE-2008-0655 | CVE-2008-0655 | T1203 T1204.002 | |
pdf_exploit_Collab_getIcon_CVE_2009_0927 |
pdf.exploit Collab.getIcon CVE-2009-0927 | CVE-2009-0927 | T1203 T1204.002 | |
pdf_suspicious_util_printd_used_to_fill_buffers |
pdf.suspicious util.printd used to fill buffers | — | T1027 T1059.007 | |
pdf_exploit_media_newPlayer_CVE_2009_4324 |
pdf.exploit media.newPlayer CVE-2009-4324 | CVE-2009-4324 | T1203 T1204.002 | |
pdf_exploit_spell_customDictionaryOpen_CVE_2009_1493 |
pdf.exploit spell.customDictionaryOpen CVE-2009-1493 | CVE-2009-1493 | T1203 T1204.002 | |
pdf_exploit_util_printf_CVE_2008_2992 |
pdf.exploit util.printf CVE-2008-2992 | CVE-2008-2992 | T1203 T1204.002 | |
pdf_exploit_using_TIFF_overflow_CVE_2010_0188 |
pdf.exploit using TIFF overflow CVE-2010-0188 | CVE-2010-0188 | T1203 T1204.002 | |
suspicious_string_TIFF_overflow_exploit_tif_name_CVE_2010_0188 |
suspicious.string TIFF overflow exploit.tif name CVE-2010-0188 | CVE-2010-0188 | T1203 T1204.002 | |
suspicious_string_base_64_nop_sled_used_in_TIFF_overflow_CVE_2010_0188 |
suspicious.string base 64 nop sled used in TIFF overflow CVE-2010-0188 | CVE-2010-0188 | T1203 T1204.002 | |
pdf_exploit_TIFF_overflow_CVE_2010_0188 |
pdf.exploit TIFF overflow CVE-2010-0188 | CVE-2010-0188 | T1203 T1204.002 | |
pdf_execute_access_system32_directory |
pdf.execute access system32 directory | — | T1203 T1204.002 | |
suspicious_string_obfuscated_unicode_NOP_sled |
suspicious.string obfuscated unicode NOP sled | — | T1027 | |
suspicious_flash_Embedded_Flash |
suspicious.flash Embedded Flash | — | — | |
suspicious_flash_Embedded_Flash_define_obj |
suspicious.flash Embedded Flash define obj | — | T1204.002 | |
pdf_exploit_fontfile_SING_table_overflow_CVE_2010_2883_generic |
pdf.exploit fontfile SING table overflow CVE-2010-2883 generic | CVE-2010-2883 | T1203 T1204.002 | |
pdf_exploit_fontfile_SING_table_overflow_CVE_2010_2883_A |
pdf.exploit fontfile SING table overflow CVE-2010-2883 A | CVE-2010-2883 | T1203 T1204.002 | |
flash_exploit_CVE_2011_0609 |
flash.exploit CVE-2011-0609 | CVE-2011-0609 | T1203 T1204.002 | |
flash_exploit_CVE_2011_0611 |
flash.exploit CVE-2011-0611 | CVE-2011-0611 | T1203 T1204.002 | |
flash_suspicious_jit_spray |
flash.suspicious jit_spray | — | T1027 T1059.007 | |
pdf_exploit_U3D_CVE_2011_2462_A |
pdf.exploit U3D CVE-2011-2462 A | CVE-2011-2462 | T1203 T1204.002 | |
pdf_exploit_PRC_CVE_2011_4369_A |
pdf.exploit PRC CVE-2011-4369 A | CVE-2011-4369 | T1203 T1204.002 | |
flash_exploit_flash_calling_malformed_MP4_CVE_2012_0754 |
flash.exploit flash calling malformed MP4 CVE-2012-0754 | CVE-2012-0754 | T1203 T1204.002 | |
flash_exploit_MP4_Loader_CVE_2012_0754_B |
flash.exploit MP4 Loader CVE-2012-0754 B | CVE-2012-0754 | T1203 T1204.002 | |
flash_exploit_MP4_CVE_2012_0754 |
flash.exploit MP4 CVE-2012-0754 | CVE-2012-0754 | T1203 T1204.002 | |
pdf_exploit_Sandbox_Bypass_CVE_2013_0641 |
pdf.exploit Sandbox Bypass CVE-2013-0641 | CVE-2013-0641 | T1203 T1204.002 | |
pdf_exploit_BMP_RLE_integer_heap_overflow_CVE_2013_2729 |
pdf.exploit BMP RLE integer heap overflow CVE-2013-2729 | CVE-2013-2729 | T1203 T1204.002 | |
pdf_exploit_ToolButton_use_after_free_CVE_2014_0496 |
pdf.exploit ToolButton use-after-free CVE-2014-0496 | CVE-2014-0496 | T1203 T1204.002 | |
suspicious_javascript_addToolButton |
suspicious.javascript addToolButton | — | T1059.007 | |
suspicious_embedded_doc_file |
suspicious.embedded doc file | — | T1204.002 | |
suspicious_embedded_xls_file |
suspicious.embedded xls file | — | T1204.002 | |
suspicious_embedded_ppt_file |
suspicious.embedded ppt file | — | T1204.002 | |
suspicious_embedded_scr_file |
suspicious.embedded scr file | — | T1204.002 | |
suspicious_embedded_exe_file |
suspicious.embedded exe file | — | T1204.002 | |
suspicious_embedded_bat_file |
suspicious.embedded bat file | — | T1204.002 | |
suspicious_embedded_rtf_file |
suspicious.embedded rtf file | — | T1204.002 | |
suspicious_embedded_mso_file |
suspicious.embedded mso file | — | T1204.002 | |
suspicious_embedded_html_file |
suspicious.embedded html file | — | T1204.002 | |
suspicious_embedded_OLE_document_header |
suspicious.embedded OLE document header | — | T1204.002 | |
suspicious_embedded_external_link |
information.external link | — | T1566.002 | |
pdf_exploit_Corrupted_JPEG2000_CVE_2018_4990 |
pdf.exploit Corrupted JPEG2000 CVE-2018-4990 | CVE-2018-4990 | T1203 T1204.002 | |
pdf_exploit_using_jbig2decode_CVE_2009_0658 |
pdf.exploit using JBIG2Decode CVE-2009-0658 | CVE-2009-0658 | T1203 T1204.002 | |
pdf_exploit_CVE_2023_21608 |
pdf.exploit Use-After-Free Vulnerability CVE-2023-21608 | CVE-2023-21608 | T1203 T1204.002 | |
pdf_exploit_JSF_obfuscated_payload |
pdf.exploit JSF Obfuscated payload | — | T1027 T1059.007 | |
pdf_exploit_exportDataObject_dropper |
pdf.exploit exportDataObject payload launch | — | T1059.007 T1203 | |
pdf_exploit_launch_action |
pdf.exploit Launch action command execution | — | T1059 T1204.002 | |
pdf_exploit_smb_hash_leak_CVE_2018_4993 |
pdf.exploit SMB NTLM hash leak via remote UNC path (CVE-2018-4993) | CVE-2018-4993 | T1187 | |
pdf_exploit_fontmatrix_js_CVE_2024_4367 |
pdf.exploit Mozilla PDF.js FontMatrix arbitrary JavaScript execution (CVE-2024-4367) | CVE-2024-4367 | T1059.007 T1203 | |
pdf_exploit_foxit_uaf_CVE_2018_9948_9958 |
pdf.exploit Foxit Reader addAnnot destroy Use-After-Free RCE (CVE-2018-9948 / CVE-2018-9958) | CVE-2018-9948 CVE-2018-9958 | T1059.007 T1203 | |
pdf_exploit_cff_font_stack_overflow_CVE_2010_1797 |
pdf.exploit FreeType/CoolType CFF Type2 charstring stack overflow (CVE-2010-1797) | CVE-2010-1797 | T1203 | |
pdf_exploit_geturl_file_CVE_2017_10951 |
pdf.exploit Foxit Reader getURL local file execution (CVE-2017-10951) | CVE-2017-10951 | T1203 T1204.002 | |
pdf_exploit_js_string_reverse_eval_shellcode |
pdf.exploit obfuscated JavaScript string-reversal shellcode loader (CVE-2007-5659) | CVE-2007-5659 | T1027 T1059.007 | |
pdf_suspicious_name_hex_obfuscation |
pdf.warning dictionary name hex-escape obfuscation | — | T1027 | |
pdf_exploit_CVE_2026_34621 |
pdf.exploit Adobe Acrobat/Reader UTF-16BE Names escape & Widget Base64 JS RCE (CVE-2026-34621) | CVE-2026-34621 | T1059.007 T1203 | |
pdf_exploit_xfa_xxe_CVE_2025_66516 |
pdf.exploit Apache Tika/PDFBox XFA XML External Entity (XXE) injection (CVE-2025-66516) | CVE-2025-66516 | T1190 T1203 | |
pdf_exploit_embedded_rar_CVE_2025_8088 |
pdf.exploit embedded WinRAR archive with NTFS ADS path traversal (CVE-2025-8088) | CVE-2025-8088 | T1203 T1564.004 | |
pdf_suspicious_single_page_url |
pdf.warning single-page PDF containing external URI link | — | T1204.001 T1566.001 | |
pdf_suspicious_download_lure_text |
pdf.warning PDF external link paired with download, attachment, or reader-error lure text | — | T1204.001 T1566.001 | |
executable_win_pe |
MZ Header | — | T1027 | EXECUTABLES |
executable_win_pe_transposed |
MZ Transposed | — | T1027 | EXECUTABLES |
executable_win_pe_transposed_offbyone |
MZ transposed and shifted | — | T1027 | EXECUTABLES |
executable_win |
EXE strings | — | T1027 | EXECUTABLES |
executable_win_transposed |
Transposition cipher | — | T1027 | EXECUTABLES |
executable_win_rtl |
Right to Left compression LZNT1 | — | T1027 | EXECUTABLES |
executable_win_reversed |
EXE is stored backwards | — | T1027 | EXECUTABLES |
executable_vb |
VB script | — | T1059.005 | EXECUTABLES |
executable_macosx |
Mac executable | — | T1027 | EXECUTABLES |
executable_unhandled_compression |
compression script | — | T1027.015 | EXECUTABLES |
executable_encoded_pe |
Base64 or Hex encoded Windows PE executable | — | T1027 | EXECUTABLES |
executable_lnk_shortcut |
Embedded Windows LNK shortcut executing command or script | — | T1204.002 | EXECUTABLES |
executable_scriptlet_hta_sct |
Embedded HTA or COM Scriptlet payload | — | T1218.005 | EXECUTABLES |
executable_elf |
ELF executable header | — | T1027 | EXECUTABLES |
ai_prompt_injection_system_override |
AI/RAG prompt injection: embedded system instruction override in document stream | — | T1059 | AI_SAFETY |
ai_pdf_invisible_or_zero_font_text |
AI/RAG evasion: PDF stream uses invisible text rendering mode (3 Tr) or micro/zero font size with instruction text | — | T1027 | AI_SAFETY |
ai_rag_markdown_exfiltration_beacon |
AI/RAG data exfiltration: embedded Markdown image beacon designed to leak conversation or RAG context | — | T1041 | AI_SAFETY |
ai_office_vanish_hidden_prompt_injection |
AI/RAG evasion: Word OOXML hidden text (<w:vanish/>) paired with LLM instruction override | — | T1564 | AI_SAFETY |
ai_agent_tool_call_hijack |
AI Agent / MCP hijack: spoofed tool_call or function_call tags embedded in untrusted document | — | T1059 | AI_SAFETY |