Browse Rules

Crypto Wallet File Access by Unsigned or Untrusted Binary

Detects when a suspicious process attempts to access a crypto wallet sensitive file. This is an alpha version of this rule and meant to be used to assess and test.

Potential HawkEyes Stealer Infection

Identifies the use of a browser to perform browser or internet location discovery from an unusual process. HawKEyes infostealer performs this action to assess potential targets.

Unsigned DLL Loaded by an Elastic Signed Binary

Identifies the load of an unsigned or untrusted DLL by an Elastic signed binary. This may indicate a potential DLL sideloading attempt.

Process Stared via Remote Thread

Identifies the creation of a process with parent call stack not pointing to normal process creation APIs. This may indicate process creation as a result of code injection.

Potential Execution via Sliver Framework

Identifies the execution of commands via Windows PowerShell with a pattern specific to the Sliver pentesting framework. Sliver is an open source cross-platform adversary emulation and red team framework.

Potential Injection via the Console Window Class

Identifies the execution of a process from the Windows Console host and from an unbacked memeory region. This may indicate an attempt to inject code via the ConsoleWindowClass method.

Keystroke Messages Hooking via SetWindowsHookEx

Identifies attempts to install an application-defined hook procedure to monitor keystroke messages. Adversaries may log user keystrokes to intercept credentials or other information from the user as the user types them.

Suspicious Windows Authentication Registry Modification

Identifies registry modification that may affect the Windows Logon or the Local Security Authority (LSA) service behaviors for persistence or credential access such as installing a rogue password filter or notification packages.

Suspicious Installer Remote Plugin Service Child Process

Detects when the macOS installer application remote plugin service invokes a suspicious process. This activity is highly suspicious and could indicate a malicious installer package attempting to gain initial access via XPC.

Code Editor Untrusted or Unsigned Child Process Execution

Detects when a code editor (VSCode, Cursor, or IntelliJ IDEA) spawns a shell to execute a self-signed and untrusted binary. This activity is indicative of a malicious 3rd party plugin or extension.

Background Process Execution via Shell

Detects when a binary located in a suspicious location gets executed by a shell interpreter and put in the background via the & operator. Malwares may execute their payloads in the background in an effort to remain hidden.

File Download Piped to Script Interpreter

Detects when curl or wget is utilized to download a payload and pipe it to a script interpreter for immediate execution. This activity occurs when a file is downloaded and passed to a interpreter via a shell.

Suspicious Windows API Call from Virtual Disk or USB

Identifies calls to Memory injection related Windows APIs from a process executing from a mounted virtual disk or a removable device. This may indicate an attempt to get initial access via malicious ISO or USB devices.

Startup Persistence from a Browser or Compression Utility Descendant

Identifies when a process is a descendant of a browser or compression utility is writing to commonly abused persistence locations (registry run keys and startup folder). Adversaries may use this technique to maintain persistence on an endpoint.

Process Creation from a Stomped Module

Identifies the creation of process where the parent process call stack contains a DLL with suspicious memory properties. This may be the result of a code injection using module stomping or DLL hollowing via overwriting the content of legit DLL with malicious code.

Potential Masquerading as System Binary

Detects the execution, by root, of a non-Apple binary passing the path to a System binary as command-line arguments. This activity has only been observed being used by malware in order to masquerade as the system process for the purpose of remaining hidden on the victim machine.

New System Kext File and Immediate Load via KextLoad

Detects the use of the cp or mv binaries to add a kext file in the System extensions directory and then immediately load it via the kextload utility. Threat actors have created malicious kernel extensions and attempted to load them on compromised systems in order to bypass defences and manipulate their presence on the machine.

Potential Payload Download via AppleScript Applet

Identifies activity where an AppleScript applet is executed followed by the immediate execution of the "curl" command. An attacker might use an AppleScript applet to automate malicious tasks and leverage "curl" to download additional payloads or communicate with a command and control (C2) server. This activity has been observed being utilized by XCSSET and more recently by a new threat deemed "Rustbucket" by JAMF to bypass Gatekeeper and download a second stage payload.