Browse Rules

Deprecated - Adobe Hijack Persistence

Detects writing executable files that will be automatically launched by Adobe on launch.

Persistence via Microsoft Office AddIns

Detects attempts to establish persistence on an endpoint by abusing Microsoft Office add-ins.

Command Execution via SolarWinds Process

A suspicious SolarWinds child process (Cmd.exe or Powershell.exe) was detected.

Persistence via Microsoft Outlook VBA

Detects attempts to establish persistence on an endpoint by installing a rogue Microsoft Outlook VBA Template.

Enumeration Command Spawned via WMIPrvSE

Identifies native Windows host and network enumeration commands spawned by the Windows Management Instrumentation Provider Service (WMIPrvSE).

Remote File Download via MpCmdRun

Identifies the Windows Defender configuration utility (MpCmdRun.exe) being used to download a remote file.

Suspicious Execution with NodeJS

Identifies suspicious Node.js execution patterns, including PowerShell-launched module preloads and inline eval, decode, or child-process usage.

Suspicious Windows Powershell Arguments

Identifies the execution of PowerShell with suspicious argument values. This behavior is often observed during malware installation leveraging PowerShell.

Command and Scripting Interpreter via Windows Scripts

Identifies PowerShell, PowerShell ISE, or Cmd execution spawned from Windows Script Host or MSHTA.

Credential Acquisition via Registry Hive Dumping

Identifies attempts to export a registry hive which may contain credentials using the Windows reg.exe tool.

System File Ownership Change

Adversaries may modify file or directory ownership to evade access control lists (ACLs) and access protected files.

Unusual Parent-Child Relationship

Identifies Windows programs run from unexpected parent processes. This could indicate masquerading or other strange activity on a system.

Bypass UAC via Event Viewer

Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass UAC to stealthily execute code with elevated permissions.

Persistence via TelemetryController Scheduled Task Hijack

Detects the successful hijack of Microsoft Compatibility Appraiser scheduled task to establish persistence with an integrity level of system.

Unusual Process Execution Path - Alternate Data Stream

Identifies processes running from an Alternate Data Stream. This is uncommon for legitimate processes and sometimes done by adversaries to hide malware.

Remote File Copy to a Hidden Share

Identifies a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity.

Suspicious Managed Code Hosting Process

Identifies a suspicious managed code hosting process which could indicate code injection or other form of suspicious code execution.

User Account Creation

Identifies attempts to create new users. This is sometimes done by attackers to increase access or establish persistence on a system or domain.

Modification of Boot Configuration

Identifies use of bcdedit.exe to delete boot configuration data. This tactic is sometimes used as by malware or an attacker as a destructive technique.

Service DACL Modification via sc.exe

Identifies DACL modifications to deny access to a service, making it unstoppable, or hide it from system and users.

Execution via TSClient Mountpoint

Identifies execution from the Remote Desktop Protocol (RDP) shared mountpoint tsclient on the target host. This may indicate a lateral movement attempt.

Peripheral Device Discovery

Identifies use of the Windows file system utility (fsutil.exe) to gather information about attached peripheral devices and components connected to a computer system.

Suspicious Cmd Execution via WMI

Identifies suspicious command execution (cmd) via Windows Management Instrumentation (WMI) on a remote host. This could be indicative of adversary lateral movement.

Web Shell Detection: Script Process Child of Common Web Processes

Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access.

Windows Defender Exclusions Added via PowerShell

Identifies modifications to the Windows Defender configuration settings using PowerShell to add exclusions at the folder directory or process level.