Browse Rules

Suspicious Security Product Enumeration

Enumeration of security products may be a precursor to Defense Evasion.

CVE-2023-0386 Exploitation Attempt

Detects an attempt to exploit the CVE-2023-0386 local privilege escalation vulnerability.

Unbacked Shellcode from Unsigned Module

Identifies attempt to allocate or execute Shellcode from a module with low or unknown reputation.

Unusual Registry Modification via WMI

Identifies registry modification via Windows Management Instrumentation to point to an executable or script file.

Suspicious Call Stack Trailing Bytes

Identifies API or library events with suspicious call stack trailing bytes often related to shellcode execution.

Windows Defender Exclusions by Extension

Identifies modifications to the Windows Defender configuration settings to exclude specific executable file types by extension.

Windows Defender Exclusions by Path

Identifies modifications to the Windows Defender configuration settings to exclude a recently dropped or modified executable.

Potential Shellcode Injection via Node.js

Identifies shellcode injection from a Node.js application. This may indicate an attempt to evade defenses.

Suspicious Memory Protection Fluctuation

Identifies mutiple calls to change the memory protection of a memory address to avoid leaving suspicious allocation properties.

NetworkCleartext Logon by a Suspicious Process

Identifies NetworkCleartext logon attempt by an unusual process. Adversaries may leverage compromised credentials to bypass access controls.

Potential Injection from a LUA Script

Identifies potential code injection from a LUA script interpreter. This may indicate an attempt to evade defenses.

Suspicious Memory Page Protection

Identifies memory regions unexpectedly marked as inaccessible. This may indicate an attempt to hide injected code from memory scanners.

Execution via Obfuscated PowerShell Script

Identifies the execution of PowerShell with potentially obfuscated content. This behavior is often observed during malware installation leveraging PowerShell.

Suspicious NTDLL Memory Write

Identifies attempts to modify the memory region of NTDLL. This may indicate an attempt to unhook or perform code injection.

Suspicious PowerShell Base64 Decoding

Identifies the execution of PowerShell with suspicious base64 decoding activity. This behavior is often observed during malware installation leveraging PowerShell.

Potential Browser Information Discovery

Identifies attempts to access browser history and bookmarks files. Adversaries may enumerate information about browsers to learn more about compromised environments.

Suspicious API call via a Windows Installer Module

Identifies suspicious API calls from a Windows Installer module. This behavior is consistent with code injection attacks.

Unusual Windows System Service Disabled

Identifies attempts to disable certain Windows security related services such as the Windows Defender or System Updates via registry modification.

Crypto Wallet File Access by Unsigned or Untrusted Binary

Detects when a suspicious process attempts to access a crypto wallet sensitive file. This is an alpha version of this rule and meant to be used to assess and test.

Suspicious JavaScript Execution via Deno

Identifies attempts to execute JavaScript using Deno with suspicious command line value. Adversaries may abuse this utility to execute malicious JavaScript.

Suspicious Memory Protection Change via VirtualProtect

Identifies when a process attempts to allocate shellcode memory region using VirtualProtect API changing memory protections from RW to RX.

Execution via Obfuscated Windows Script

Identifies the execution of a Windows script with potential obfuscated content. Adversaries may employ script obfuscation techniques to evade static detection methods.

Execution via SyncAppvPublishingServer

Identifies the execution of powershell command via a Microsoft signed Visual Basic script Syncappvpublishingserver.vbs. Adversaries may use this method to bypass application whitelisting.

Microsoft Office AddIn Creation

Detects attempts to create or modify a file in known Microsoft Office add-ins directories. Adversaries may leverage Microsoft Office Addins for persistence.

Native API Call from Unsigned Module

Identifies suspicious calls to Windows Native APIs from a unsigned module. This may indicate an attempt to bypass Kernelbase APIs hooking.