Browse Rules

Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder

Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains.

Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder

Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains.

Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location

Detects a network connection initiated by programs or processes running from suspicious or uncommon files system locations.

Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location

Detects a network connection initiated by programs or processes running from suspicious or uncommon files system locations.

Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder

Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains.

Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location

Detects a network connection initiated by programs or processes running from suspicious or uncommon files system locations.

HH.EXE Initiated HTTP Network Connection

Detects a network connection initiated by the "hh.exe" process to HTTP destination ports, which could indicate the execution/download of remotely hosted .chm files.

HH.EXE Initiated HTTP Network Connection

Detects a network connection initiated by the "hh.exe" process to HTTP destination ports, which could indicate the execution/download of remotely hosted .chm files.

HH.EXE Initiated HTTP Network Connection

Detects a network connection initiated by the "hh.exe" process to HTTP destination ports, which could indicate the execution/download of remotely hosted .chm files.

Execution of a File Dropped from SMB

Identifies the execution of a file that was created by the virtual system process and subsequently executed. This may indicate lateral movement via network file shares.

Unexpected SMB Connection from User-mode Process

Identifies unexpected processes making network connections over port 445. Windows File Sharing is typically implemented over Server Message Block (SMB), which communicates between hosts using port 445. When legitimate, these network connections are established by the kernel. Processes making 445/tcp connections may be port scanners, exploits, or suspicious user-level processes moving laterally.

Outbound Network Connection Followed by Process File Deletion

This rule detects a network connection attempt to an external IP address followed by a file deletion event where the file path is the same as the process executable. This behavior may indicate an attempt to cover tracks by deleting the file used to establish the connection, and may be used by attackers to hide their tracks upon successfully establishing a connection to a C2 server.

Windows Network Access Suspicious desktop.ini Action

Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.

Windows Network Access Suspicious desktop.ini Action

Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.

Memory File Descriptor Execution from Suspicious Process

This rule detects when a process creates an in-memory file descriptor (memfd_create) followed by an egress network connection from an unusual executable. This sequence of events may indicate malicious activity, such as fileless malware execution and command and control communication.

Network Connection with Suspicious Folder [splunk-sysmon]

Detects potential downloads to suspicious file locations like temp, appdata, and downloads. - Threat Actor Association: Alloy Taurus/Gallium, Lazarus, NewsPenguin, OilRig, TA413 - Software Association: LOWZERO, Vidar Stealer

Suspicious Image Load by System Protected Process

Identifies when a System protected process loads a library from a network file share. This may indicate an attempt to bypass PPL protection and inject malicious code into a protected process or disable security software.

Cisco NVM - Suspicious Download From File Sharing Website

This analytic detects suspicious downloads from common file sharing and content delivery platforms using known living-off-the-land binaries (LOLBins) such as 'curl.exe', 'certutil.exe', 'msiexec.exe', 'powershell.exe', 'wmic.exe', and others. It leverages Cisco Network Visibility Module logs to correlate network flow activity with process context, including command-line arguments, process path, and parent process information. These tools are often abused by adversaries and malware to retrieve pa

Network Activity via (Memory) File Descriptor

This rule detects when a process creates a (memory) file descriptor and attempts, or accepts, a network connection. This activity indicates an active attempt to execute a fileless payload and should be considered highly abnormal or suspicious. This activity can occur when the memfd syscall is used to create a memory-resident file, such as a payload, and then execute it, after which it establishes outbound network connections for command-and-control (C2).

Launch Remote File Copy Tools in Container

Detect remote file copy tools (like rsync, scp, sftp, dcp) launched within a container, potentially indicating data exfiltration. Suggest refining this rule to accommodate legitimate use cases.

Egress Network Connection from Deleted Executable by Root

This rule detects network connections initiated by a process that has been deleted from the filesystem. This behavior may indicate an attempt to evade detection by removing the malicious executable after execution.

Egress Network Connection Followed by Memory File Descriptor Creation

This rule detects when a process establishes an outbound network connection followed by creating an in-memory file using the memfd_create syscall. This activity indicates an active attempt to execute a fileless payload and should be considered highly abnormal or suspicious. This activity can occur when the memfd syscall is utilized to create a memory resident file, like a payload, and then uses it to execute a process via a command and control channel, resulting in an exec event.

Egress Network Connection from Memory File Descriptor

This rule detects when a process creates an in-memory file descriptor (memfd_create) followed by an egress network connection from an unusual executable. This activity indicates an active attempt to execute a fileless payload and should be considered highly abnormal or suspicious. This activity can occur when the memfd syscall is used to create a memory-resident file, such as a payload, and then execute it, after which it establishes outbound network connections for command-and-control (C2).

Windows Hosts File Access

This Analytic detects the execution of a process attempting to access the hosts file. The hosts file is a critical file for network configuration and DNS resolution. If an attacker gains access to it, they can redirect traffic to malicious websites, serve fake content or block legitimate security websites.

Egress Network Connection by MOTD Child

This rule detects network connections to external IP's immediatly after the process execution of a file within the message of the day (MOTD) configuration directory. This could be indicative of a persistence mechanism being established on the system.