title: Blacklisted Process Execution
id: c8597820-be6a-5d34-85dc-e3a2166e2a18
custom_id: wf-mal-006
status: stable
level: critical
description: |
    Detects execution of processes on the organization's blacklist. These are
    known-bad executables, prohibited tools, or applications that violate
    security policy.
author: WitFoo
date: 2026-02-21
tags:
    - attack.execution
    - attack.t1059
references:
    - https://attack.mitre.org/techniques/T1059/
logsource:
    product: witfoo
    service: artifact-exporter
detection:
    selection:
        messageType: "blacklisted_process"
    condition: selection
fields:
    - clientIP
    - userName
    - program
    - fileName
    - filePath
    - fileHash
    - matchedLeadRules
falsepositives:
    - Approved exceptions for security testing tools
    - Software evaluation during change management