Browse Rules

Hiding Files With Attrib.exe

Detects usage of attrib.exe to hide files from users.

Impacket Wmiexec Module

Detection of impacket's wmiexec example, used by attackers to execute commands remotely.

Mshta Suspicious Child Process

Detects the use of various web request methods executed remotely via Windows PowerShell

Powershell AMSI Bypass

This rule aims to detect attempts to bypass AMSI in PowerShell using specific techniques.

Microsoft Defender Antivirus Disable Services

The rule detects attempts to deactivate/disable Microsoft Defender Antivirus (MDAV) through command line and registry.

Microsoft Defender Antivirus Disabled Base64 Encoded

Detects attempts to deactivate/disable Microsoft Defender Antivirus (MDAV) through base64 encoded PowerShell command line.

Usage Of Procdump With Common Arguments

Detects the usage of Procdump sysinternals tool with some common arguments and followed by common patterns.

Exchange PowerShell Snap-Ins To Export Exchange Mailbox Data

Detects PowerShell SnapIn command line, often used with Get-Mailbox to export Exchange mailbox data.

Non-Legitimate Executable Using AcceptEula Parameter

Detects accepteula in command line with non-legitimate executable name. Some attackers are masquerading SysInternals tools with decoy names to prevent detection.

Microsoft Defender Antivirus Set-MpPreference Base64 Encoded

Detects changes of preferences for Microsoft Defender Antivirus (MDAV) scan and updates. Configuring MDAV with base64-encoded commands is suspicious and could be related to malicious activities.

Microsoft Defender Antivirus Signatures Removed With MpCmdRun

Detects attempts to remove Microsoft Defender Antivirus (MDAV) Signatures using MpCmdRun legitimate MDAV executable. No signatures mean MDAV will be less effective (or completely useless depending on the option used).

PowerShell AMSI Deactivation Bypass Using .NET Reflection

Detects Request to amsiInitFailed that can be used to disable AMSI (Antimalware Scan Interface) Scanning. More information about Antimalware Scan Interface https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal.

Windows Defender Disabled

The rule detects attempts to deactivate/disable Windows Defender through command line or registry. To fully use this rule Windows Registry logging is needed. This can be done for instance using Sysmon with Event IDs 12,13 and 14 (and adding the correct path in its configuration).

Windows PUA Named Pipe

The following analytic detects the creation or connection to named pipes used by potentially unwanted applications (PUAs) like VPNs or utilities like PsExec. It leverages Sysmon EventCodes 17 and 18. If confirmed malicious, this could allow an attacker to abuse these to potentially gain persistence, command and control, or further system compromise.

Windows Suspicious C2 Named Pipe

The following analytic detects the creation or connection to known suspicious C2 named pipes. It leverages Sysmon EventCodes 17 and 18 to identify known default pipe names used by C2 tools. If confirmed malicious, this could allow an attacker to abuse these to potentially gain persistence, command and control, or further system compromise.

Suspicious SSH Child Process - *nix [splunk-edr]

Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. This use case detects potentially suspicious SSH (sshd) child processes with a specific execution user. This could be a sign of potential exploitation of CVE-2024-3094.

Windows Suspicious Named Pipe

The following analytic detects the creation or connection to known suspicious named pipes. It leverages Sysmon EventCodes 17 and 18 to identify known default pipe names used by malicious or suspicious tools. If confirmed malicious, this could allow an attacker to abuse these to potentially gain privilege escalation, persistence, c2 communications, or further system compromise.

Suspicious SSH Child Process - *nix [snowflake-crowdstrikefdr_process]

Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. This use case detects potentially suspicious SSH (sshd) child processes with a specific execution user. This could be a sign of potential exploitation of CVE-2024-3094.

Data Compressed With Rar With Password

An adversary may compress data in order to make it portable and minimize the amount of data sent over the network, this could be done the popular rar command line program. This is a more specific one for rar where the arguments allow to encrypt both file data and headers with a given password.

Windows RMM Named Pipe

The following analytic detects the creation or connection to known suspicious named pipes, which is a technique often used by offensive tools. It leverages Sysmon EventCodes 17 and 18 to identify known default pipe names used by RMM tools. If confirmed malicious, this could allow an attacker to abuse these to potentially gain persistence, command and control, or further system compromise.

Linux Possible Nimbuspwn Privilege Escalation

The following analytic detects directory traversal attempts associated with Nimbuspwn, a Linux privilege escalation vulnerability affecting the networkd-dispatcher service. Nimbuspwn exploits weaknesses in the networkd-dispatcher service to traverse directories and execute arbitrary code with elevated privileges. If confirmed malicious, this activity could allow an attacker to escalate privileges to root, potentially leading to full system compromise, persistent unauthorized access, and the abil

Script Execution via WMI

The following analytic detects the execution of scripts via Windows Management Instrumentation (WMI) by monitoring the process 'scrcons.exe'. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events. WMI-based script execution is significant because adversaries often use it to perform malicious activities stealthily, such as system compromise, data exfiltration, or establishing persistence. If confirmed malicious, this activity could al

Windows AppCertDLL Modification Via Registry

This analytic detects attempts to modify AppCertDLL registry entries. Values under this registry entry are used to specify DLLs loaded by the Windows Session Manager. Such modifications can be abused by attackers to load malicious code early in the system startup process, enabling persistent malware execution with high privileges. If confirmed malicious, this behavior may lead to system compromise, persistence, and the evasion of security controls.

Windows InstallUtil Remote Network Connection

The following analytic detects the Windows InstallUtil.exe binary making a remote network connection. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and network telemetry. This activity is significant because InstallUtil.exe can be exploited to download and execute malicious code, bypassing application control mechanisms. If confirmed malicious, an attacker could achieve code execution, potentially leading to further system compromise, data exfiltration,

Dump LSASS via comsvcs DLL

The following analytic detects the behavior of dumping credentials from memory by exploiting the Local Security Authority Subsystem Service (LSASS) using the comsvcs.dll and MiniDump via rundll32. This detection leverages process information from Endpoint Detection and Response (EDR) logs, focusing on specific command-line executions. This activity is significant because it indicates potential credential theft, which can lead to broader system compromise, persistence, lateral movement, and privi