Malicious DOCX File Execution Detected via MISP IOC and VirusTotal
This rule detects the creation or launch of processes or files that have a SHA256 hash matching an Indicator of Compromise (IOC) from MISP, specifically when the file is identified by VirusTotal as an MS Office DOCX file type. It correlates process/file events with threat intelligence data to identify potentially malicious activity involving weaponized documents.
YARA-L
