Executable or script written by a consumer messaging client

Siemphony@siemphonylowT1566.003unverifiedPlaybook · Unexpected execution

Takes the delivery leg of AN0320 and pins it to the writing process rather than to a folder: a desktop chat or social client — the non-enterprise channel that defines this sub-technique — creating a file of an executable, script, shortcut or disk-image type on the endpoint. The mail secure-cache path used for T1566.001 structurally cannot see this, because a message delivered through a third-party service never touches the mail client, and a rule keyed on a browser writing the file would be the drive-by logic already authored for T1189, so the client process list is the discriminator that remains. These clients rewrite their own program and cache trees on every release — an Electron self-update unpacks hundreds of .js files under its own AppData directory, under the same process name — so those trees are excluded by path, and that filter is the difference between a rule that reports deliveries and one that reports updates. Microsoft Teams is left out because internal chat between colleagues would make sharing a build the normal case, which does mean the external-tenant Teams route used in several recent intrusions is not covered here. The largest blind spot is the extension list itself: a payload sent as a .zip, .7z or .docm matches nothing, and those are the usual wrappers precisely because users reach for an archive for anything multi-file — they are excluded because they are also the bulk of what colleagues legitimately exchange over chat. Two further limits: MITRE's MonitoredServices and TimeWindow knobs describe a correlation across the message, the write and the follow-on execution that Sigma has no construct for, so this fires on delivery alone; and it requires Sysmon EventID 11 with neither these processes nor these extensions excluded, which the widely deployed community configurations do not leave intact. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0115, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Executable or script written by a consumer messaging client2id: 37af02a5-9579-4511-8246-3337ec2415323status: experimental4description: |5  Takes the delivery leg of AN0320 and pins it to the writing process rather than6  to a folder: a desktop chat or social client — the non-enterprise channel that7  defines this sub-technique — creating a file of an executable, script, shortcut8  or disk-image type on the endpoint. The mail secure-cache path used for9  T1566.001 structurally cannot see this, because a message delivered through a10  third-party service never touches the mail client, and a rule keyed on a11  browser writing the file would be the drive-by logic already authored for12  T1189, so the client process list is the discriminator that remains. These13  clients rewrite their own program and cache trees on every release — an14  Electron self-update unpacks hundreds of .js files under its own AppData15  directory, under the same process name — so those trees are excluded by path,16  and that filter is the difference between a rule that reports deliveries and17  one that reports updates. Microsoft Teams is left out because internal chat18  between colleagues would make sharing a build the normal case, which does mean19  the external-tenant Teams route used in several recent intrusions is not20  covered here. The largest blind spot is the extension list itself: a payload21  sent as a .zip, .7z or .docm matches nothing, and those are the usual wrappers22  precisely because users reach for an archive for anything multi-file — they23  are excluded because they are also the bulk of what colleagues legitimately24  exchange over chat. Two further limits: MITRE's MonitoredServices and25  TimeWindow knobs describe a correlation across the message, the write and the26  follow-on execution that Sigma has no construct for, so this fires on delivery27  alone; and it requires Sysmon EventID 11 with neither these processes nor28  these extensions excluded, which the widely deployed community configurations29  do not leave intact.30  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0115, not hand-written and not tested by its author. Any lab result is on this rule's own page.31references:32  - https://attack.mitre.org/techniques/T1566/00333  - https://attack.mitre.org/detectionstrategies/DET011534author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)35date: 2026-08-1636tags:37  - attack.initial-access38  - attack.t1566.00339logsource:40  category: file_event41  product: windows42detection:43  selection_service_client:44    Image|endswith:45      - '\Discord.exe'46      - '\Telegram.exe'47      - '\Signal.exe'48      - '\slack.exe'49      - '\Skype.exe'50      - '\Viber.exe'51      - '\Element.exe'52      - '\WhatsApp.exe'53  selection_payload:54    TargetFilename|endswith:55      - '.exe'56      - '.msi'57      - '.scr'58      - '.pif'59      - '.com'60      - '.bat'61      - '.cmd'62      - '.ps1'63      - '.vbs'64      - '.vbe'65      - '.js'66      - '.jse'67      - '.wsf'68      - '.hta'69      - '.lnk'70      - '.chm'71      - '.jar'72      - '.iso'73      - '.img'74      - '.vhd'75      - '.vhdx'76  filter_client_own_tree:77    TargetFilename|contains:78      - '\AppData\Local\Discord\'79      - '\AppData\Local\DiscordPTB\'80      - '\AppData\Local\DiscordCanary\'81      - '\AppData\Local\slack\'82      - '\AppData\Roaming\Slack\'83      - '\AppData\Roaming\Telegram Desktop\'84      - '\AppData\Local\Programs\signal-desktop\'85      - '\AppData\Roaming\Signal\'86      - '\AppData\Local\Programs\element-desktop\'87      - '\AppData\Roaming\Element\'88      - '\AppData\Local\Microsoft\Skype for Desktop\'89      - '\AppData\Roaming\Microsoft\Skype for Desktop\'90      - '\AppData\Local\Viber\'91      - '\AppData\Roaming\ViberPC\'92      - '\AppData\Local\WhatsApp\'93      - '\AppData\Local\SquirrelTemp\'94      - '\AppData\Local\Packages\'95  condition: selection_service_client and selection_payload and not filter_client_own_tree96falsepositives:97  - "Engineering and IT staff sharing builds, installers and helper scripts over chat. A colleague dropping an .exe, .msi or .jar into a Slack or Discord channel writes precisely this event, and in a software organisation it is the highest-volume match by a wide margin. Allow-list by the receiving account or the channel, not by shortening the extension list, which is the rule's only signal."98  - "Chat client self-update staged outside the client's own directories. The path filter covers the install and cache trees, but an updater that drops its new setup .exe or .msi into %TEMP% or into the user's Downloads folder writes under the same process name and still matches, on every release train, on every installed client in the estate."99  - "Helpdesk workflows that send a remote-support agent or a signed driver package to a user over chat instead of through the software distribution system, which is common where the user is off the corporate network."100  - "Lab and training content, where .iso and .vhdx images and .lnk shortcuts to shared locations are ordinary attachments in engineering and course channels."101level: low

Sentinel · KQL

Run this as a search.

DeviceFileEvents| where (((InitiatingProcessFolderPath endswith "\\Discord.exe" or InitiatingProcessFolderPath endswith "\\Telegram.exe" or InitiatingProcessFolderPath endswith "\\Signal.exe" or InitiatingProcessFolderPath endswith "\\slack.exe" or InitiatingProcessFolderPath endswith "\\Skype.exe" or InitiatingProcessFolderPath endswith "\\Viber.exe" or InitiatingProcessFolderPath endswith "\\Element.exe" or InitiatingProcessFolderPath endswith "\\WhatsApp.exe") and (FolderPath endswith ".exe" or FolderPath endswith ".msi" or FolderPath endswith ".scr" or FolderPath endswith ".pif" or FolderPath endswith ".com" or FolderPath endswith ".bat" or FolderPath endswith ".cmd" or FolderPath endswith ".ps1" or FolderPath endswith ".vbs" or FolderPath endswith ".vbe" or FolderPath endswith ".js" or FolderPath endswith ".jse" or FolderPath endswith ".wsf" or FolderPath endswith ".hta" or FolderPath endswith ".lnk" or FolderPath endswith ".chm" or FolderPath endswith ".jar" or FolderPath endswith ".iso" or FolderPath endswith ".img" or FolderPath endswith ".vhd" or FolderPath endswith ".vhdx")) and not ((FolderPath contains "\\AppData\\Local\\Discord\\" or FolderPath contains "\\AppData\\Local\\DiscordPTB\\" or FolderPath contains "\\AppData\\Local\\DiscordCanary\\" or FolderPath contains "\\AppData\\Local\\slack\\" or FolderPath contains "\\AppData\\Roaming\\Slack\\" or FolderPath contains "\\AppData\\Roaming\\Telegram Desktop\\" or FolderPath contains "\\AppData\\Local\\Programs\\signal-desktop\\" or FolderPath contains "\\AppData\\Roaming\\Signal\\" or FolderPath contains "\\AppData\\Local\\Programs\\element-desktop\\" or FolderPath contains "\\AppData\\Roaming\\Element\\" or FolderPath contains "\\AppData\\Local\\Microsoft\\Skype for Desktop\\" or FolderPath contains "\\AppData\\Roaming\\Microsoft\\Skype for Desktop\\" or FolderPath contains "\\AppData\\Local\\Viber\\" or FolderPath contains "\\AppData\\Roaming\\ViberPC\\" or FolderPath contains "\\AppData\\Local\\WhatsApp\\" or FolderPath contains "\\AppData\\Local\\SquirrelTemp\\" or FolderPath contains "\\AppData\\Local\\Packages\\")))

Splunk · SPL

Run this as a search.

index=* (((Image="*\\Discord.exe" OR Image="*\\Telegram.exe" OR Image="*\\Signal.exe" OR Image="*\\slack.exe" OR Image="*\\Skype.exe" OR Image="*\\Viber.exe" OR Image="*\\Element.exe" OR Image="*\\WhatsApp.exe") AND (TargetFilename="*.exe" OR TargetFilename="*.msi" OR TargetFilename="*.scr" OR TargetFilename="*.pif" OR TargetFilename="*.com" OR TargetFilename="*.bat" OR TargetFilename="*.cmd" OR TargetFilename="*.ps1" OR TargetFilename="*.vbs" OR TargetFilename="*.vbe" OR TargetFilename="*.js" OR TargetFilename="*.jse" OR TargetFilename="*.wsf" OR TargetFilename="*.hta" OR TargetFilename="*.lnk" OR TargetFilename="*.chm" OR TargetFilename="*.jar" OR TargetFilename="*.iso" OR TargetFilename="*.img" OR TargetFilename="*.vhd" OR TargetFilename="*.vhdx")) AND NOT ((TargetFilename="*\\AppData\\Local\\Discord\\*" OR TargetFilename="*\\AppData\\Local\\DiscordPTB\\*" OR TargetFilename="*\\AppData\\Local\\DiscordCanary\\*" OR TargetFilename="*\\AppData\\Local\\slack\\*" OR TargetFilename="*\\AppData\\Roaming\\Slack\\*" OR TargetFilename="*\\AppData\\Roaming\\Telegram Desktop\\*" OR TargetFilename="*\\AppData\\Local\\Programs\\signal-desktop\\*" OR TargetFilename="*\\AppData\\Roaming\\Signal\\*" OR TargetFilename="*\\AppData\\Local\\Programs\\element-desktop\\*" OR TargetFilename="*\\AppData\\Roaming\\Element\\*" OR TargetFilename="*\\AppData\\Local\\Microsoft\\Skype for Desktop\\*" OR TargetFilename="*\\AppData\\Roaming\\Microsoft\\Skype for Desktop\\*" OR TargetFilename="*\\AppData\\Local\\Viber\\*" OR TargetFilename="*\\AppData\\Roaming\\ViberPC\\*" OR TargetFilename="*\\AppData\\Local\\WhatsApp\\*" OR TargetFilename="*\\AppData\\Local\\SquirrelTemp\\*" OR TargetFilename="*\\AppData\\Local\\Packages\\*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.executable) LIKE "*\\\\discord.exe" OR TO_LOWER(process.executable) LIKE "*\\\\telegram.exe" OR TO_LOWER(process.executable) LIKE "*\\\\signal.exe" OR TO_LOWER(process.executable) LIKE "*\\\\slack.exe" OR TO_LOWER(process.executable) LIKE "*\\\\skype.exe" OR TO_LOWER(process.executable) LIKE "*\\\\viber.exe" OR TO_LOWER(process.executable) LIKE "*\\\\element.exe" OR TO_LOWER(process.executable) LIKE "*\\\\whatsapp.exe") AND (TO_LOWER(file.path) LIKE "*.exe" OR TO_LOWER(file.path) LIKE "*.msi" OR TO_LOWER(file.path) LIKE "*.scr" OR TO_LOWER(file.path) LIKE "*.pif" OR TO_LOWER(file.path) LIKE "*.com" OR TO_LOWER(file.path) LIKE "*.bat" OR TO_LOWER(file.path) LIKE "*.cmd" OR TO_LOWER(file.path) LIKE "*.ps1" OR TO_LOWER(file.path) LIKE "*.vbs" OR TO_LOWER(file.path) LIKE "*.vbe" OR TO_LOWER(file.path) LIKE "*.js" OR TO_LOWER(file.path) LIKE "*.jse" OR TO_LOWER(file.path) LIKE "*.wsf" OR TO_LOWER(file.path) LIKE "*.hta" OR TO_LOWER(file.path) LIKE "*.lnk" OR TO_LOWER(file.path) LIKE "*.chm" OR TO_LOWER(file.path) LIKE "*.jar" OR TO_LOWER(file.path) LIKE "*.iso" OR TO_LOWER(file.path) LIKE "*.img" OR TO_LOWER(file.path) LIKE "*.vhd" OR TO_LOWER(file.path) LIKE "*.vhdx")) AND NOT ((TO_LOWER(file.path) LIKE "*\\\\appdata\\\\local\\\\discord\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\appdata\\\\local\\\\discordptb\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\appdata\\\\local\\\\discordcanary\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\appdata\\\\local\\\\slack\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\appdata\\\\roaming\\\\slack\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\appdata\\\\roaming\\\\telegram desktop\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\appdata\\\\local\\\\programs\\\\signal-desktop\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\appdata\\\\roaming\\\\signal\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\appdata\\\\local\\\\programs\\\\element-desktop\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\appdata\\\\roaming\\\\element\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\appdata\\\\local\\\\microsoft\\\\skype for desktop\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\appdata\\\\roaming\\\\microsoft\\\\skype for desktop\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\appdata\\\\local\\\\viber\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\appdata\\\\roaming\\\\viberpc\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\appdata\\\\local\\\\whatsapp\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\appdata\\\\local\\\\squirreltemp\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\appdata\\\\local\\\\packages\\\\*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,file_event,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\Discord\.exe$|\\Telegram\.exe$|\\Signal\.exe$|\\slack\.exe$|\\Skype\.exe$|\\Viber\.exe$|\\Element\.exe$|\\WhatsApp\.exe$)</field>    <field name="TargetFilename" type="pcre2">(?i)(\.exe$|\.msi$|\.scr$|\.pif$|\.com$|\.bat$|\.cmd$|\.ps1$|\.vbs$|\.vbe$|\.js$|\.jse$|\.wsf$|\.hta$|\.lnk$|\.chm$|\.jar$|\.iso$|\.img$|\.vhd$|\.vhdx$)</field>    <field name="TargetFilename" negate="yes" type="pcre2">(?i)(\\AppData\\Local\\Discord\\|\\AppData\\Local\\DiscordPTB\\|\\AppData\\Local\\DiscordCanary\\|\\AppData\\Local\\slack\\|\\AppData\\Roaming\\Slack\\|\\AppData\\Roaming\\Telegram Desktop\\|\\AppData\\Local\\Programs\\signal-desktop\\|\\AppData\\Roaming\\Signal\\|\\AppData\\Local\\Programs\\element-desktop\\|\\AppData\\Roaming\\Element\\|\\AppData\\Local\\Microsoft\\Skype for Desktop\\|\\AppData\\Roaming\\Microsoft\\Skype for Desktop\\|\\AppData\\Local\\Viber\\|\\AppData\\Roaming\\ViberPC\\|\\AppData\\Local\\WhatsApp\\|\\AppData\\Local\\SquirrelTemp\\|\\AppData\\Local\\Packages\\)</field>    <description>Executable or script written by a consumer messaging client</description>    <mitre>      <id>T1566.003</id>    </mitre>  </rule></group>

At a glance

Logsource: file_event / windows
Level: low
Category: office_macro_execution
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 37af02a5-9579-4511-8246-3337ec241532

ATT&CKT1566.003

T1566.003Spearphishing via Service

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 3 fired

Fires on none of the 3 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 3 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1566.003, evaluated against their file_event events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add more specific filtering to exclude known legitimate executable or script files written by the messaging clients
Implement a whitelist of allowed executable or script extensions for the messaging clients
Modify the filter_client_own_tree selection to include more specific paths or exclude certain subdirectories
Consider adding additional conditions, such as checking the file's digital signature or reputation

Declared by the author

Engineering and IT staff sharing builds, installers and helper scripts over chat. A colleague dropping an .exe, .msi or .jar into a Slack or Discord channel writes precisely this event, and in a software organisation it is the highest-volume match by a wide margin. Allow-list by the receiving account or the channel, not by shortening the extension list, which is the rule's only signal.
Chat client self-update staged outside the client's own directories. The path filter covers the install and cache trees, but an updater that drops its new setup .exe or .msi into %TEMP% or into the user's Downloads folder writes under the same process name and still matches, on every release train, on every installed client in the estate.
Helpdesk workflows that send a remote-support agent or a signed driver package to a user over chat instead of through the software distribution system, which is common where the user is off the corporate network.
Lab and training content, where .iso and .vhdx images and .lnk shortcuts to shared locations are ordinary attachments in engineering and course channels.

Lessonoffice macro execution

office macro executionAI draft — unreviewed

01 · What this rule detects

This Sigma rule detects when a consumer messaging client, such as Discord, Telegram, or Skype, is used to write an executable or script file to a location outside of its own directory tree, which could indicate malicious activity, such as office macro execution. The rule looks for file creation events where the messaging client is the source process and the target file has an executable or script extension.

02 · Telemetry you need

Log source: file_event from a Windows system
Specific fields: Image, TargetFilename
Audit setting: File creation events must be audited, which may require enabling audit logging for file system events

03 · How the logic works

The rule selects events where the Image field ends with the name of a consumer messaging client, such as \Discord.exe or \Telegram.exe. It also selects events where the TargetFilename field ends with an executable or script extension, such as .exe, .bat, or .ps1. The rule then filters out events where the TargetFilename field contains a path within the messaging client's own directory tree, such as \AppData\Local\Discord\. The condition requires all three selections to be true: the messaging client must be the source process, the target file must be executable or a script, and the target file must not be within the client's own directory tree.

04 · Common false positives

Legitimate software updates or installations triggered by the messaging client
Users running scripts or executables from within the messaging client for legitimate purposes, such as automation or development
False positives from other processes that happen to have the same name as a messaging client

05 · Detection maturity

tier_1: The rule as written may generate a high volume of false positives and requires significant tuning to be effective.
tier_2: With additional filtering and whitelisting, the rule can be tuned to reduce false positives and detect more targeted attacks.
tier_3: Correlating this rule with other signals, such as network traffic or system calls, can help to identify more sophisticated attacks and improve the overall detection capability.

Related detections5 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/37af02a5-9579-4511-8246-3337ec241532

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Executable or script written by a consumer messaging client

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it