Browse Rules

[CROWDSTRIKE] Execution Tactic Catchall

[CROWDSTRIKE] Execution Tactic Catchall

Execution of an Unsigned Service

This rule identifies the execution of unsigned executables via service control manager (SCM). Adversaries may abuse SCM to execute malware or escalate privileges.

Shell Execution via Elastic Endpoint

This rule detects shell executions via Elastic Endpoint. Elastic Endpoint has a built-in response action console that can be used to execute shell commands on compromised systems.

Proxy Shell Execution via Busybox

Detects the execution of a shell through Busybox. Attackers may use this technique to execute shells while attempting to evade detection.

Apple Scripting Execution with Administrator Privileges

Identifies execution of the Apple script interpreter (osascript) without a password prompt and with administrator privileges.

Suspicious Command Execution via Busybox Proxy

This rule detects the execution of command line arguments capable of spawning shells or establishing network connections through Busybox. This technique can be used to execute commands while attempting to evade detection.

Potential Execution via SSH Backdoor

It identifies potential malicious shell executions through remote SSH and detects cases where the sshd service suddenly terminates soon after successful execution, suggesting suspicious behavior similar to the XZ backdoor.

Suspicious Execution via Scheduled Task

Identifies execution of a suspicious program via scheduled tasks by looking at process lineage and command line usage.

Git Hook Command Execution

This rule detects the execution of a potentially malicious process from a Git hook. Git hooks are scripts that Git executes before or after events such as: commit, push, and receive. An attacker can abuse Git hooks to execute arbitrary commands on the system and establish persistence.

Delayed Execution via Ping

Identifies the execution of commonly abused Windows utilities via a delayed Ping execution. This behavior is often observed during malware installation and is consistent with an attacker attempting to evade detection.

Potential Masquerading as System32 Executable

Identifies suspicious instances of default system32 executables, either unsigned or signed with non-MS certificates. This could indicate the attempt to masquerade as system executables or backdoored and resigned legitimate executables.

Suspicious Interpreter Execution Detected via Defend for Containers

This rule detects when a process executes a suspicious interpreter command inside a container. These commands are commonly used by attackers to execute malicious code or exfiltrate data.

Suspicious Portable Executable Encoded in Powershell Script

Detects PowerShell scripts that includes a base64-encoded portable executable (PE) header, indicating an embedded binary payload. Attackers embed PEs in scripts to load payloads in memory and avoid writing executables to disk.

Suspicious WMIC XSL Script Execution

Identifies WMIC allowlist bypass techniques by alerting on suspicious execution of scripts. When WMIC loads scripting libraries it may be indicative of an allowlist bypass.

Apple Script Execution followed by Network Connection

Detects execution via the Apple script interpreter (osascript) followed by a network connection from the same process within a short time period. Adversaries may use malicious scripts for execution and command and control.

Execution via MS VisualStudio Pre/Post Build Events

Identifies the execution of a command via Microsoft Visual Studio Pre or Post build events. Adversaries may backdoor a trusted visual studio project to execute a malicious command during the project build process.

Suspicious Process Execution via Renamed PsExec Executable

Identifies suspicious psexec activity which is executing from the psexec service that has been renamed, possibly to evade detection.

Curl or Wget Egress Network Connection via LoLBin

This rule detects the execution of curl or wget binaries through a GTFOBin (living-off-the-land) technique in Linux environments. Attackers may exploit these utilities to download and execute malicious files from the internet while attempting to evade detection. The rule specifically targets binaries that are capable of executing shell commands directly from the proxied binary, rather than just spawning a shell.

Suspicious Shell Execution via Velociraptor

Detects shell executions (cmd, PowerShell, rundll32) spawned by Velociraptor. Threat actors have been observed installing Velociraptor to execute shell commands on compromised systems, blending in with legitimate system processes.

Potential Masquerading as Business App Installer

Identifies executables with names resembling legitimate business applications but lacking signatures from the original developer. Attackers may trick users into downloading malicious executables that masquerade as legitimate applications via malicious ads, forum posts, and tutorials, effectively gaining initial access.

Deprecated - PowerShell Script with Remote Execution Capabilities via WinRM

Identifies the use of Cmdlets and methods related to remote execution activities using WinRM. Attackers can abuse WinRM to perform lateral movement using built-in tools.

Dynamic Linker (ld.so) Creation

This rule detects the creation of the dynamic linker (ld.so). The dynamic linker is used to load shared libraries needed by an executable. Attackers may attempt to replace the dynamic linker with a malicious version to execute arbitrary code.

Ingress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers

This rule detects the creation, execution, and deletion of files inside a container, a common technique used by attackers to evade detection.

Node.js Pre or Post-Install Script Execution

This rule detects the execution of Node.js pre or post-install scripts. These scripts are executed by the Node.js package manager (npm) during the installation of packages. Adversaries may abuse this technique to execute arbitrary commands on the system and establish persistence. This activity was observed in the wild as part of the Shai-Hulud worm.

Payload Execution via Shell Pipe Detected by Defend for Containers

This rule detects when a payload is downloaded and piped to a shell inside a running container. This could indicate a threat actor downloaded a payload and executed it using a shell without the payload being stored on the filesystem.