Browse Rules

Mshta Suspicious Child Process

Detects the use of various web request methods executed remotely via Windows PowerShell

Microsoft Defender Antivirus Threat Detected

Detection of a Microsoft Defender Antivirus (MDAV) alert indicating the presence of potential malware

C# IL Code Compilation Via Ilasm.EXE

Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL.

Microsoft Defender Antivirus Disable Services

The rule detects attempts to deactivate/disable Microsoft Defender Antivirus (MDAV) through command line and registry.

C# IL Code Compilation Via Ilasm.EXE

Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL.

C# IL Code Compilation Via Ilasm.EXE

Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL.

Usage Of Procdump With Common Arguments

Detects the usage of Procdump sysinternals tool with some common arguments and followed by common patterns.

AWS CloudTrail IAM Password Policy Updated

Detects an update to the password policy. This could be an attempt to lower accounts security level.

Exchange PowerShell Snap-Ins To Export Exchange Mailbox Data

Detects PowerShell SnapIn command line, often used with Get-Mailbox to export Exchange mailbox data.

Non-Legitimate Executable Using AcceptEula Parameter

Detects accepteula in command line with non-legitimate executable name. Some attackers are masquerading SysInternals tools with decoy names to prevent detection.

ISO LNK Infection Chain

Detection of an ISO download followed by a child-process of explorer, which is characteristic of an infection using an ISO containing an LNK file.

HTML Smuggling Suspicious Usage

Based on several samples from different Botnets, this rule aims at detecting HTML infection chain by looking for HTML created files followed by suspicious files being executed.

AWS CloudTrail EC2 Enable Serial Console Access

Detects when the EC2 serial console access feature is enabled. This could abused by some attackers to avoid network detection when accessing to EC2 instances.

Microsoft Defender Antivirus Set-MpPreference Base64 Encoded

Detects changes of preferences for Microsoft Defender Antivirus (MDAV) scan and updates. Configuring MDAV with base64-encoded commands is suspicious and could be related to malicious activities.

SOCKS Tunneling Tool

Detects the usage of a SOCKS tunneling tool, often used by threat actors. These tools often use the socks5 commandline argument, however socks4 can sometimes be used as well. Unfortunately, socks alone (without any number) triggered too many false positives.

Windows Defender Disabled

The rule detects attempts to deactivate/disable Windows Defender through command line or registry. To fully use this rule Windows Registry logging is needed. This can be done for instance using Sysmon with Event IDs 12,13 and 14 (and adding the correct path in its configuration).

Data Compressed With Rar With Password

An adversary may compress data in order to make it portable and minimize the amount of data sent over the network, this could be done the popular rar command line program. This is a more specific one for rar where the arguments allow to encrypt both file data and headers with a given password.

Wmic Process Call Creation

The WMI command-line (WMIC) utility provides a command-line interface for Windows Management Instrumentation (WMI). WMIC is compatible with existing shells and utility commands. Although WMI is supposed to be an administration tool, it is wildy abused by threat actors. One of the reasons is WMI is quite stealthy. This rule detects the wmic command line launching a process on a remote or local host.

Risk Rule for Dev Sec Ops by Repository

The following analytic identifies high-risk activities within repositories by correlating repository data with risk scores. It leverages findings and intermediate findings created by detections from the Dev Sec Ops analytic stories, summing risk scores and capturing source and user information. The detection focuses on high-risk scores above 100 and sources with more than three occurrences. This activity is significant as it highlights repositories frequently targeted by threats, providing insig

Abnormally Large Shell Script Execution via Perl

Detects when Perl spawns a shell interpreter to execute an abnormally large script, indicated by a null command line despite having the expected argument count. This technique is commonly observed in npm typosquatting attacks where malicious packages use Perl as an intermediary to execute large embedded payloads that exceed normal command line size limits. Adversaries leverage Perl's trusted status to execute obfuscated or encoded shell scripts that perform credential harvesting, data exfiltrati

Suspicious Curl to Raw IP via Perl

Detects when curl or nscurl is spawned by Perl to make an outbound network connection to a raw IP address over HTTP (port 80). This technique is commonly observed in npm typosquatting attacks where malicious packages use Perl as an intermediary to execute curl commands for downloading additional payloads or exfiltrating data. Perl's trusted binary status on macOS makes it an attractive vector for adversaries to execute suspicious network operations while evading detection.

FortiGate SOCKS Traffic from an Unusual Process

This detection correlates FortiGate's application control SOCKS events with Elastic Defend network event to identify the source process performing SOCKS traffic. Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure.

ProxyChains Activity

This rule monitors for the execution of the ProxyChains utility. ProxyChains is a command-line tool that enables the routing of network connections through intermediary proxies, enhancing anonymity and enabling access to restricted resources. Attackers can exploit the ProxyChains utility to hide their true source IP address, evade detection, and perform malicious activities through a chain of proxy servers, potentially masking their identity and intentions.

Suspicious Utility Launched via ProxyChains

This rule monitors for the execution of suspicious linux tools through ProxyChains. ProxyChains is a command-line tool that enables the routing of network connections through intermediary proxies, enhancing anonymity and enabling access to restricted resources. Attackers can exploit the ProxyChains utility to hide their true source IP address, evade detection, and perform malicious activities through a chain of proxy servers, potentially masking their identity and intentions.