Browse Rules

Windows Defender Exclusions by Extension

Identifies modifications to the Windows Defender configuration settings to exclude specific executable file types by extension.

Suspicious PowerShell Base64 Decoding

Identifies the execution of PowerShell with suspicious base64 decoding activity. This behavior is often observed during malware installation leveraging PowerShell.

Potential Browser Information Discovery

Identifies attempts to access browser history and bookmarks files. Adversaries may enumerate information about browsers to learn more about compromised environments.

Unusual Windows System Service Disabled

Identifies attempts to disable certain Windows security related services such as the Windows Defender or System Updates via registry modification.

Suspicious Memory Protection Change via VirtualProtect

Identifies when a process attempts to allocate shellcode memory region using VirtualProtect API changing memory protections from RW to RX.

Potential Remote Desktop Protocol Tunneling

Identifies remote interactive logon attempt with from the localhost as a source address. This may indicate the initiation of a Remote Desktop Tunneling session.

Keystroke Input Capture via DirectInput

Identifies attempts to enumerate keystroke state using the Windows DirectInput API. Adversaries may log user keystrokes to intercept credentials or other information from the user as the user types them.

Startup Persistence by a Low Reputation Process

Identifies when a process with low or unknown reputation is writing to commonly abused persistence locations (registry run keys and startup folder). Adversaries may use this technique to maintain persistence on an endpoint.

Process Creation from Backed RWX Memory

Identifies attempts to create a child process from a memory section with read, write and execute permissions and backed by a file on disk. This may indicate image hollowing or unpacking from suspicious memory sections.

Egress Network Connection from RPM Package

This rule monitors for egress network connections from processes that are executed from an RPM package parent. Attackers can backdoor an RPM package to establish initial access, or install a malicious RPM package to maintain persistence.

Evasion via LdrpKernel32 Overwrite

Identifies attempts to load a malicious DLL early via hijacking the normal NTDLL bootstrap process. Instead of loading kernel32 it will load a malicious one that may execute malicious code and resume the rest of the loading process steps.

Remote Process Injection via Mapping

Identifies attempts to map a view of a file or a page file-backed section with execute and write permissions into the address space of a remote process. This may indicate an attempt to inject code via memory mapping.

Cloud Credential Files Accessed by Process in Suspicious Directory

Identifies an untrusted or unsigned process accessing cloud credential and configuration files. Adversaries may attempt to access these files in order to gain access to sensitive data, laterally move or gain initial access into a cloud environment.

User TCC DB Access by Unsigned or Untrusted Process

Detects the attempt to access or open the users TCC database by an unsigned or untrusted binary. This activity may indicate the presence of a malicious payload attempting to bypass TCC or gain awareness of system permissions in place.

Hidden Folder or File Access in Tmp via Python

Detects possible Python based malware that stage their files in a hidden directory or file that sits within the tmp directory. This rule looks for Python executions where the process arguments include references to hidden folders or files in the tmp directory.

Unsigned DLL from Suspicious Directory

Identifies a Windows trusted program running from locations often abused by adversaries to masquerade as a trusted program and loading a recently dropped DLL. This behavior may indicate an attempt to evade defenses via side-loading a malicious DLL within the memory space of a signed processes.

Potential Privilege Escalation via Fuse Binary

This rule identifies the execution of the "fuse" binary by the root user, excluding cases where the user's group is not root or the parent process is sudo. Such behavior is likely considered anomalous and may suggest an attempt at privilege escalation, potentially leveraging the CVE-2023-0386 vulnerability.

Curl Execution via Apple Installer Package

Detects when curl is executed with the -o option and the effective parent process is an Apple installer process. Threat actors will utilize benign or backdoored software packages to download second stage payloads using curl in order to avoid detection and gain malicious code execution. An example of this activity is the nation state malware known as oRAT.