Browse Rules

Unusual Registry Modification via WMI

Identifies registry modification via Windows Management Instrumentation to point to an executable or script file.

Suspicious Memory Protection Fluctuation

Identifies mutiple calls to change the memory protection of a memory address to avoid leaving suspicious allocation properties.

Native API Call from Unsigned Module

Identifies suspicious calls to Windows Native APIs from a unsigned module. This may indicate an attempt to bypass Kernelbase APIs hooking.

NewCredential Logon by a Suspicious Process

Identifies NewCredential logon attempt with alternate credentials and by an unusual process. Adversaries may create a new token to escalate privileges and bypass access controls.

Keystroke Input Capture via RegisterRawInputDevices

Identifies attempts to register for input from the keyboard using RegisterRawInputDevices API. Adversaries may log user keystrokes to intercept credentials or other information from the user as the user types them.

Potential Linux Reverse Shell via Java JAR Execution

Identifies the execution of a Linux shell process from a Java JAR application post an incoming network connection. This behavior may indicate reverse shell activity via a Java application.

VirtualAlloc API Call from an Unsigned DLL

Identifies the load of an unsigned or untrusted DLL by a trusted binary followed by calling VirtualAlloc API to allocate executable memory. This may indicate execution via DLL sideloading to perform code injection.

Suspicious Powershell Child Process

Detects when Powershell (pwsh) spawns a highly abnormal or suspicious child process. Powershell usage on macOS is extremely rare but usage of Powershell to spawn a process like curl or osascript is almost always indicative of malicious behavior.

Keystrokes Input Capture from Unsigned DLL

Identifies attempts to enumerate the state of keyboard keys and the call is coming from an unsigned DLL. Adversaries may log user keystrokes to intercept credentials or other information from the user as the user types them.

Mach-O File with Unusual Extension

Identifies the creation or modification of an Mach-O file with an unexpected file extension. Attackers may attempt to evade detection by masquerading files using the file extension values used by image, audio, or document file types.

Suspicious Execution from a Windows Script

Identifies a Windows script interpreter executing for more than 5 minutes followed by spawning a child process. This may indicate long term network activity from a Windows script which is common pattern of a command and control backdoor via malicious scripts.

Chattr Execution with Unusual Target File

This rule detects the execution of the "chattr" command with an unusual target file. The "chattr" command is used to change file attributes, and is often used by attackers to hide files or directories or mark them as immutable and/or undeletable.

Suspicious Stop of TCCD via Launchctl

Detects the abnormal stop of the TCC daemon via the launchctl system binary. This activity can indicate an attempt to restart the TCC daemon following an exploit and may indicate a threat actors attempt to bypass security controls, escalate privileges, evade defenses.

Curl Executable File Download via Osascript

Detects the execution of curl via osascript with the "-o" argument indicating a file download. This activity should be highly abnormal and considered suspicious at least. Threat actors have consistently been seen utilizing this technique to establish C2 or download additional payloads / tools.

Suspicious Executable Download via Ruby

Detects when Ruby makes a network connection followed immediately by the rename or modification of a macOS binary. This initial diagnostic rule is meant to allow for an analysis of this activity and tune this rule to detect potential malicious initial access via Ruby scripts or packages.

Potential Browser Exploit via Fake RPC Messages

Identifies attempt to call memory manipulation APIs or load a library where call stack is pointing to the RPC function NdrServerCall, this may indicate an attempt to exploit a vulnerability using fake RPC messages to bypass CFG mitigation. A known example of vulnerability using this primitive is CVE-2021-26411.

Egress Network Connection Followed by Command Execution

Detects network connections originating from a binary located in a potentially suspicious location, followed by command execution. This behavior is consistent with C2 agents such as Poseidon and Athena, connecting to a C2 framework such as Mythic. The agent polls the C2 for commands through a web request, after which the command gets executed.