Browse Rules

CVE-2023-0386 Exploitation Attempt

Detects an attempt to exploit the CVE-2023-0386 local privilege escalation vulnerability.

Potential Shellcode Injection via Node.js

Identifies shellcode injection from a Node.js application. This may indicate an attempt to evade defenses.

Suspicious Component Object Model Registry Modification

Identifies Component Object Model (COM) hijacking via registry modification. Adversaries may establish persistence by executing malicious content triggered by hijacked references to COM objects.

Potential Remote Code Injection

Identifies attempt to allocate an executable memory region in a remote process followed by writing content to it. This behavior is consistent with remote code injection attacks.

Potential Shellcode Injection via CLR

Identifies attempts to allocate or execute shellcode from unbacked memory and where the protection provenance of the unbacked region is coming from the Microsoft Common Language Runtime DLL.

Suspicious Activity from a Control Panel Applet

Identifies an attempt to load a network library or perform API calls to manipulate memory from an unsigned Control Panel Applet and located in unusual folders.

Suspicious Null Terminated Call Stack

Detects Windows Memory API calls from a null terminated thread call stack. This could be the result of an attempt to conceal the true source of the call.

Potential Evasion via Stack Rumbling

Identifies modification of the Image File Execution Options registry value MinimumStackCommitInBytes. Adversaries may abuse this key to force the crash of an endpoint security solution due to stack overflow.

Potential Reverse Shell via Java

Identifies the execution of a shell process from a Java JAR application post an incoming network connection. This behavior may indicate a reverse shell activity via malicious Java application.

Windows System Module Remote Hooking

Identifies attempts to write to a remote process memory to modify NTDLL or Kernelbase modules. This may indicate an attempt to evade endpoint security solutions or perform code injection.

Potential Obfuscated Script Execution

Detection involves spotting the generation of a file exhibiting high entropy, which is subsequently executed using frequently abused script interpreters. Adversaries may employ script obfuscation techniques to evade static detection methods.

Suspicious API from an Unsigned Service DLL

Identifies the execution of a new service via unsigned ServiceDLL subsequently followed by suspicious Windows API calls. Adversaries may use this technique to maintain persistence or run with System privileges.

Potential Protocol Tunneling via Legit Utilities

Identifies the use of known legit utilities to potentially tunnel network traffic. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.

Linux Powershell Suspicious Child Process

Detects when Powershell (pwsh) spawns a highly abnormal or suspicious child process. Powershell usage on Linux is rare, and leveraging Powershell to launch any of this list of suspicious utilities may indicate malicious behavior.

LSASS Memory Read via PPL Bypass

Identifies attempts to access the Local Security Authority Subsystem Service (LSASS) running as a Protected Process and from a non Protected Process. Adversaries may exploit vulnerabilities or leverage vulnerable drivers to bypass LSA protection.

Powershell Outbound Network Connection

Detects when Powershell (pwsh) on macOS makes an outbound network connection attempt. Powershell usage on macOS is extremely rare but usage of Powershell to connect out to the internet is almost always indicative of malicious behavior.

Process Execution from Boot Directory

This rule detects the execution of processes from the /boot directory. This may indicate an attempt to execute a process from a location that is not typical for executable files. This behavior is often associated with malicious activity.

File Download from Suspicious Top Level Domain

Identifies network connections to commonly abused Top Level Domains followed by the immdiate creation of a Python, Shell Script, Applescript, or Binary. This may indicate an attempt to establish initial access or command and control by a malicious payload.

Potential Coin Miner Execution via Shell

This rule detects the execution of a coin miner via a shell command through potential mining commandline arguments. Adversaries may leverage the resources of compromised systems to mine cryptocurrency, to generate revenue. This activity may impact system performance and availability.

Potential Persistence via Direct Crontab Modification

Detects the modification of the crontab file. Attackers can modify the crontab file to execute commands at specific times or intervals to maintain persistence on the system. Modifying the crontab directly is uncommon, and abused by attackers to automate persistence.

Shared Memory File Turned Executable by Suspicious Parent

Detects when a file located in the shared memory directory is made executable using chmod via an abnormal or suspicious parent process. Malware will often drop a second stage payload or file and will need to make it executable before invoking it.

Suspicious PHP Command Execution

This rule monitors for suspicious PHP command executions by detecting the start of a PHP process with a command line argument that contains keywords commonly used by attackers to execute malicious code. These command line arguments include operations to execute code, create subprocesses, and encode or decode data.

Linux Compilation in Suspicious Directory

Detects the compilation of a binary file in a suspicious directory. Attackers may compile kernel exploits or other software on the target system, to ensure the architecture of the payload matches the target's architecture. Compilation to one of these directories can be an indication of malicious activity.

File Downloaded via Curl or Wget to Hidden Directory

This rule detects when the curl or wget command is used to download a file to a writeable hidden directory, such as /tmp, /var/tmp, or /dev/shm. This behavior is used by threat actors to evade detection and may indicate command and control activity.

Python Network Connection Followed by Command Execution

Detects network connections originating from Python, followed by a suspicious command execution. This behavior is consistent with Python-based agents such as Medusa connecting to a C2 framework such as Mythic. The agent polls the C2 for commands through a web request, after which the command gets executed.