Browse Rules

Execution via SyncAppvPublishingServer

Identifies the execution of powershell command via a Microsoft signed Visual Basic script Syncappvpublishingserver.vbs. Adversaries may use this method to bypass application whitelisting.

Suspicious Process with a Spoofed Parent

Detects attempts to start a process with a fake parent process identity to blend in with normal parent child process tree.

Suspicious Executable Memory Permission Modification

Identifies suspicious memory permission modification from read and execute R-X to read only. This may indicate an attempt to hide executable code while in sleep state.

Scheduled Task Creation via Unsigned Parent

Identifies the creation of a scheduled task using schtasks.exe utility and from a recently dropped unsigned parent process. This behavior is consistent with an adversary attempting to establish persistence.

Evasion via Event Tracing for Windows Patching

Identifies attempts to patch Microsoft Event Tracing for Windows via memory modification. This may indicate an attempt to disrupt detection of malicious activity by the Event Tracing facility for Windows.

Dual Persistence via Startup and Scheduled Task

Identifies the creation of two persistence items via startup followed by scheduled task by an unsigned executable. Adversaries may use this technique to maintain multiple methods of persistence on an endpoint.

System Binary Copied or Moved

This rule detects the copying or moving of system binaries using common shell commands. Attackers may copy or move system binaries to different locations or rename them to evade detection or maintain persistence.

Web Browser Credential Data Accessed by Unsigned or Untrusted Process

Identifies an unsigned process accessing the password store of commonly used web browsers. Adversaries may steal credentials from web browsers by reading files specific to the target browser.

LSASS Memory dump via MiniDumpWriteDump

Identifies attempt to access the Local Security Authority Subsystem Service (LSASS) to dump its memory using the Windows API MiniDumpWritedump. Adversaries may attempt to access credential material stored in the process memory of LSASS.

LSASS Access Attempt from an Unsigned Executable

Identifies attempt to access the Local Security Authority Subsystem Service (LSASS) by an unsigned process that was recently dropped. Adversaries may attempt to access credential material stored in the process memory of LSASS.

Linux Powershell Encoded Command

Detects the execution of Powershell (pwsh) with the encoded command flag set in the process arguments, in conjunction with an unusual process command line length. Powershell usage on Linux is rare, and the usage of encoded commands with unusual lengths is through Powershell may indicate malicious behavior.

Process from Archive or Removable Media via Unbacked Code

Identifies the creation of a process where the creating thread's stack contains frames pointing outside any known executable image and the parent process is executing from a mounted virtual disk, archive or USB device. This may be indicative of the creation of a process as a result of a code injection.

Suspicious URL as argument to Self-Signed Binary

Detects the execution of a binary that is untrusted by Apple and self-signed using the Codesign utility where a URL is provided as an argument to the malicious binary in order to download additional tools or establish C2. Threat actors and specifically DPRK threat actors have been see utilizing this technique in order to evade defenses when downloading additional tools or exfiltrating data.

Unsigned or Untrusted Application Launch via XPC

Detects when the xpcproxy process starts an application within the /Applications directory, and the parent process is /sbin/launchd. If an application is being launched via xpcproxy with launchd as its parent process, it generally means the application is being started as an XPC service. An application being executed in this specific manner is not normal and based on testing can indicate a malicious application being launched.