Browse Rules

Potential Injection from a LUA Script

Identifies potential code injection from a LUA script interpreter. This may indicate an attempt to evade defenses.

Suspicious Memory Page Protection

Identifies memory regions unexpectedly marked as inaccessible. This may indicate an attempt to hide injected code from memory scanners.

Suspicious NTDLL Memory Write

Identifies attempts to modify the memory region of NTDLL. This may indicate an attempt to unhook or perform code injection.

Execution via Obfuscated Windows Script

Identifies the execution of a Windows script with potential obfuscated content. Adversaries may employ script obfuscation techniques to evade static detection methods.

Potential LogonUser API Hooking

Identifies attempts to hook LogonUser API via memory modification. This may indicate an attempt to steal credentials passed for authentication verification via this API.

Decoded Payload Piped to Interpreter

This rule identifies when a decoded payload is piped to an interpreter. Malware authors may attempt to evade detection by encoding and obfuscating their payload.

Suspicious Process Creation via Reflection

Identifies the creation of process clone via the Windows API RtlCreateProcessReflection. This may indicate an attempt to create a process as a target for process injection.

Attempt to Mount a Remote WebDav Share

Identifies attempt to mount or copy files from a remote WebDav Share. Adversaries may abuse this method to evade dropping malicious files to victim file system.

Multi-Layered Deobfuscation via Unusual Parent

Detects multiple base64/xxd deobfuscation processes spawned by scripting interpreters within 5 seconds. This pattern indicates multi-layered payload decoding commonly used by malware and scripted attacks.

Possible JAVA Reverse Shell

Identifies the execution of a shell process from a Java JAR application post an incoming network connection. This behavior may indicate a reverse shell activity via malicious Java application.

Potential VScode Remote Tunnel Established

Detects the rename or modification of the code_tunnel json file which gets created or modified when a remote tunnel session is created via the VScode portable binary.

Suspicious DD Execution

Detects suspicious execution of the dd command reading from standard input, often used by infostealer malware to convert decoded data. This technique is uncommon on macOS and typically indicates malicious activity.

Suspicious PowerShell Console History Deletion

Identifies when a process attempts to delete PowerShell Console History. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.

Windows API Call via Indirect Random Syscall

Identifies calls to Windows memory APIs from unusual modules or NTDLL offsets. This may indicate an attempt to bypass API monitoring by jumping directly to syscall instructions.

API Call from a Process with a Spoofed Parent

Detects Windows Memory API calls by a process with a fake parent process identity set to Windows Explorer often to blend in with user interactive activity.

Shellcode API behavior from a signed module

Identifies shellcode API behavior from a signed final user module. This may indicate an attempt to perform code injection abusing a valid code signing certificate to avoid suspicion.

Suspicious Registry Symbolic Link

Identifies the creation of registry symbolic link by an unusual process. This may indicate an attempt to elevate privileges via hijacking privileged registry read operations using a malicious registry symbolic link.

Execution of JavaScript Payload via Python

Identifies when Python spawns the native Osascript binary to execute a Javascript payload. An adversary may use this technique to execute their malicious payload and obtain initial access to an endpoint.

Execution via WMI CommandLine Event Consumer

Identifies the creation or execution via the Windows Management Instrumentation CommandLine Event Consumer class. The CommandLineEventConsumer class starts an arbitrary process in the local system when an event is delivered to it.

File Download from or Upload to Hosting Service

This rule detects the execution of curl or wget commands that download files from hosting services. Attackers may use these services to temporary host malicious files or payloads for later execution.

Background Task Execution via a Hidden Process

This rule detects the execution of a background task via a hidden process. Attackers may use hidden processes to evade detection and establish persistence or execute post-exploitation commands on a target system.

Shell Execution of Non-Executable File

Detects the execution of an un-executable file, per file extension, via a shell interpreter. Sometimes threat actors will masquerade their payloads as non-executable files in order to avoid suspicion and go unnoticed.

Suspicious Image Creation via ScreenCapture

Detects when the ScreenCapture binary executes and creates an image in a suspicious location like tmp or the shared directory. Malware has used the ScreenCapture binary to collect images of victim systems and exfiltrate them via C2.

Suspicious Web Server Child Process

This rule detects when a web server spawns a suspicious child process. Attackers may exploit RCE or file upload vulnerabilities to spawn suspicious child processes on web servers to gain/maintain access and to establish a command and control channel.

Chattr Execution from Unusual Parent

This rule detects the execution of the "chattr" command from an unusual parent process. The "chattr" command is used to change file attributes, and is often used by attackers to hide files or directories or mark them as immutable and/or undeletable.