Browse Rules

Suspicious Call Stack Trailing Bytes

Identifies API or library events with suspicious call stack trailing bytes often related to shellcode execution.

NetworkCleartext Logon by a Suspicious Process

Identifies NetworkCleartext logon attempt by an unusual process. Adversaries may leverage compromised credentials to bypass access controls.

Execution via Obfuscated PowerShell Script

Identifies the execution of PowerShell with potentially obfuscated content. This behavior is often observed during malware installation leveraging PowerShell.

Suspicious API call via a Windows Installer Module

Identifies suspicious API calls from a Windows Installer module. This behavior is consistent with code injection attacks.

Suspicious Electron Command Execution

Detects the use of specific commandline arguments that can be used with certain Electron based applications to covertly execute code for a variety of purposes.

API Call via Jump ROP Gadget

Identifies Windows Native API calls with ROP gadgets and from an unusual Microsoft signed module. This may be the result of a code injection.

Process Creation from an Unusual WMI Client

Identify attempts to create a process calling the WMI Win32_Process Create Method. Adversaries may use WMI to indirectly spawn a child process.

Suspicious WMI Enumeration via Windows Scripts

Identifies WMI activity performed by common Windows Scripting utilities, this could be the result of the execution of a malicious JScript or VBscript malware.

Potential Remote Code Execution via Database Server

This rule detects potential remote code execution attempts via commonly used database server applications, by monitoring for unusual child processes and command line arguments.

Shell Command Discovery Execution via Untrusted Binary

Detects untrusted binaries spawning shell interpreters to execute discovery commands like whoami, osascript, and dscacheutil within 15 seconds. This pattern indicates malicious reconnaissance activities.

Execution from ZIP File via Explorer

Identifies process execution from a ZIP file when handled via Explorer. Adversaries often leverage ZIP file to deliver malicious executables and scripts for initial access and execution.

.NET COM object created in non-standard Windows Script Interpreter

Identifies the creation of a .NET COM object in an unexpected Windows script interpreter. Adversaries may utilise .NET to call arbitrary Win32 APIs from scripts.

Remote Memory Write to a non Child Process

Identifies suspicious writes to the memory space of a remote process by a process that is not a direct parent. this may indicate a code injection attempt.

Attempt to establish VScode Remote Tunnel

Detects the execution of the VScode portable binary with the tunnel command line option indicating an attempt to establish a remote tunnel session to Github or a remote VScode instance.

Attempt to Disable Driver via HVCIDisallowedImages

Identifies registry modification to disallow a driver by name using the undocumented Code Integrity registry value HVCIDisallowedImages. An adversary may abuse this setting to block Endpoint security drivers from loading after system reboot.

Potential Mining Pool Command Detection

This rule detects the execution of a process with potential mining pool commandline arguments. Adversaries may leverage the resources of compromised systems to mine cryptocurrency, to generate revenue. This activity may impact system performance and availability.

Payload Execution by Web Server

This rule detects when a web server executes a payload. Attackers may exploit RCE or file upload vulnerabilities to execute malicious payloads on web servers to gain/maintain access and to establish a command and control channel.

Curl Download and OsaScript Payload Execution via Node

Detects when curl or nscurl is executed as an argument of a shell interpreter via a node parent process. This is a common technique used by malware to download additional payloads and evade traditional defenses.

Suspicious Python Script Execution and Network Connection

Detects when Python is executed containing arguments containing suspicious file paths followed immediately by a Python network connection. We have observed malware samples that drop and execute a Python script within a suspicious directory in order to establish C2.

Initial Access via OSA Shell Script Piped to Python Interpreter

Detects when an Osascript shell script is piped to a Python interpreter for execution followed by an immediate outbound network connection for C2 establishment. This activity is observed when an Empire payload is executed for initial access.

Memory File Descriptor Execution from Suspicious Process

This rule detects when a process creates an in-memory file descriptor (memfd_create) followed by an egress network connection from an unusual executable. This sequence of events may indicate malicious activity, such as fileless malware execution and command and control communication.

Potential UAC Bypass via IElevatedFactoryServer

Identifies attempt to elevate privileges to bypass User Account Control via an elevated function ServerCreateElevatedObject exposed by the Virtual Factory for MaintenanceUI COM object. Attackers may attempt to instantiate other privileged COM objects by proxy such as the ITaskService to execute with elevated permissions.

Suspicious Shell Command Execution via Node.js Parent

This rule detects when a shell command is executed as a child process of a Node.js process. Attackers may use Node.js to run shell commands for various malicious purposes, such as downloading and executing payloads, establishing persistence, or exfiltrating data.

Abnormal Auval Child Process Execution

Detects the execution of a process that should not be executed by the native auval or auvaltool binaries. This activity may occur after a threat actor loads a malicious audio unit plug-in via auval or auvaltool providing them unsigned code execution in the context of those binaries.

Potential Command and Control via Windows Scripts

Identifies the execution of a Windows script interpreter followed by a network connection or DNS loookup request after 5 minutes of the process start. This may indicate long term network activity from a Windows script which is common pattern of a command and control backdoor via malicious scripts.