Browse Rules

Suspicious Security Product Enumeration

Enumeration of security products may be a precursor to Defense Evasion.

Microsoft Office AddIn Creation

Detects attempts to create or modify a file in known Microsoft Office add-ins directories. Adversaries may leverage Microsoft Office Addins for persistence.

Network Connect API from Unbacked Memory

Identifies attempts to perform a network connection from a suspicious unbacked memory block. This may be the result of code injection.

Suspicious Service ImagePath Value

Identifies the creation of a Windows service with a suspicious ImagePath value. Adversaries may use this technique to maintain persistence or run with System privileges.

Socat Reverse Shell or Listener Activity

This rule detects the execution of the socat command with suspicious arguments. Attackers may use socat to set up a listener or establish a reverse connection.

WaaSMedicSvc COM Type Lib Hijack

Identifies registry modification to the original WaaSMedicSvc COM TypeLib registry key used as a primitive to hijack the normal behaviour of this service for evasion and privileges elevation.

Suspicious Communication via Mail Protocol

Identifies DNS queries to Mail domain names by an unusual process. Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic.

Attempt to Disable Windows Driver Blocklist via Registry

Identifies registry modifications to disable Microsoft policy that prevents a blacklist of known vulnerable drivers. This could be indicative of adversary defense evasion by attempting to load and exploit a vulnerable driver.

Linux Hidden Folder or File Execution via Python

Detects possible Python-based malware that stages their files in a hidden directory or file. This rule looks for Python executions where the process arguments include references to hidden folders or files in the suspicious directories.

Kill Command Executed from Binary in Unusual Location

This rule detects the execution of the "kill" or "pkill" command from a binary located in an unusual location. Miners and other types of malware may attempt to kill competing processes to maintain control of the system.

Unusual SSH Parent/Child Execution

This rule detects the execution of a process from an unusual location, immediately after an SSH process is started. This could indicate an attacker attempting to execute a malicious process in the context of an SSH session, or a successfully planted backdoor within a user shell configuration.

Network Activity from Memory File Descriptor

Detects when a file descriptor in the proc (temporary) file system is executed and immediately makes an outbound network connection. This activity can occur when the memfd syscall is utilized to create a memory resident file, like a payload, and then execute it after which is establishes outbound network connections (C2).