Browse Rules

Unbacked Shellcode from Unsigned Module

Identifies attempt to allocate or execute Shellcode from a module with low or unknown reputation.

Windows Defender Exclusions by Path

Identifies modifications to the Windows Defender configuration settings to exclude a recently dropped or modified executable.

Linux Powershell Egress Network Connection

Detects when Powershell (pwsh) on Linux makes an outbound network connection attempt. Powershell usage on Linux is rare, and leveraging Powershell to connect out to the internet may indicate malicious behavior.

Decoy Document Creation via Curl

Detects when Curl is seen creating a .pdf or .doc file in a suspicious directory like /tmp or /users/shared. A recent DPRK sample was seen downloading a decoy document via Curl like this.

Remote Memory Write to Trusted Target Process

Identifies attempts to write or modify protection to the address space of a remote trusted target process and by an unsigned or untrusted final user module. This behavior is consistent with remote code injection attacks.

Suspicious Image Load by System Protected Process

Identifies when a System protected process loads a library from a network file share. This may indicate an attempt to bypass PPL protection and inject malicious code into a protected process or disable security software.

Suspicious VSCode Extension Child Process

Detects when a vscode extension spawns an abnormal or suspicious child process. This activity can indicate that a malicious extension has been installed and is attempting to perform malicious actions on a user's system for initial access, data stealing, etc.

Linux Payload Decoded and Decrypted via Built-in Utility

This rule identifies when a built-in utility is used to decode and decrypt a payload on a Linux system. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload.

Startup Persistence from Backed RWX Memory

Identifies when a process is writing to commonly abused persistence locations (registry run keys and startup folder) from a thread running from a memory section with read, write and execute permissions. This may indicate an attempt to persist from a packed or injected program.

Suspicious AppDomain Manager Configuration File

Identifies the creation of an AppDomain Manager configuration file followed by an attempt to load a recently created and unsigned DLL file by a .NET application matching the configuration file name. This may indicate an attempt to load a malicious module via DLL search order hijacking.

Payload Piped to Script Interpreter

Detects when a script interpreter executes via a shell (sh, bash, zsh) or osascript with only a single argument, being the process name and followed immediately by a network connection. This activity occurs when script code gets piped to the interpreter via a shell and that code is intended to reach out to an external destination like a C2 server.

User Keychain DB Access by Self-Signed Binary

Detects when a self-signed binary (signed with native CodeSign tool) attempts to open the user's Keychain DB. This activity is not normal and should be considered suspicious. The macOS keychain is highly sought after and targeted by threat actors as it contains sensitive credential data that can be used to further compromise a user or environment.

Udev Execution Followed by Egress Network Connection

This rule detects a process execution by udev followed by a network connection. Udev is a device manager for the Linux kernel that manages device nodes in /dev. Udev is responsible for creating and removing device nodes in /dev when devices are added or removed from the system. Udev executes scripts when devices are added or removed from the system. An attacker may abuse udev to execute malicious scripts to establish a network connection to a command and control server.