Browse Rules

Common Language Runtime Loaded via an Unsigned Module

Identifies the load of the Microsoft Common Language Runtime DLL CLR.dll from a recently dropped unsigned DLL.

Osascript Payload Drop and Execute

Detects when a payload is dropped to a temporary location and executed via osascript. This technique is used by malware like Apfell agent to establish new callbacks.

Potential Execution via Token Theft

Identifies the creation of a process running with a token duplicate and from unbacked memory. Adversaries may create a new process with a different token to escalate privileges and bypass access controls.

Process Creation via Microsoft Office Add-Ins

Identifies the creation of Microsoft Office child process as a result of a load Office Add-In. Adversaries may leverage malicious Microsoft Office Add-Ins for initial access and execution.

Parallel NTDLL Loaded from Unbacked Memory

Identifies the load of NTDLL for the second time and from an unbacked call stack. This may indicate the use of direct system calls to evade endpoint security solutions hooking Windows APIs.

Execution of a File Dropped from SMB via Services

Identifies the execution of a file that was created by the virtual system process and subsequently executed as a child of services.exe. This may indicate lateral movement via remote services.

MacOS Hidden File Mounted

Detects when a hidden file gets mounted, which has been observed being leveraged to exploit vulnerabilities that allow for mounting over sensitive parts of the filesystem, thereby bypassing certain macOS security controls such as TCC and SIP.

Potential Evasion with Hardware Breakpoints

Identifies attempt to abuse a thread debug registers along with malicious exception handlers to hijack the normal execution flow of a thread. This provides an adversary an advantage to inject commands to perform unexpected, unwanted, or malicious operations.

Scheduled Task from a Browser or Compression Utility Descendant

Identifies the creation of a scheduled task by a descendant of a browser or compression utility. This behavior is consistent with an adversary attempting to establish persistence after initial access via malicious user execution.

Potential Process Creation via ShellCode

Identifies the creation of a process where the creating thread's stack contains frames pointing outside any known executable image and using commonly used Windows APIs like WinExec. This is a common pattern for code injection using default offensive shellcode templates.

Potential Evasion via Invalid Code Signature

Identifies an attempt to load a network module from unbacked memory or perform suspicious Windows API calls by an executable with erroneous code signature. Malware may append malicious code to benign signed binaries or use invalid code signature to bypass certain security controls.

Suspicious OpenSSL Execution via macOS Application

Detects a suspicious sequence of events where a shell (bash, sh, or zsh) is used to launch an application from the /Applications directory, followed by the execution of the 'openssl' command. This pattern could indicate potential malicious activity, such as a shell script attempting to use openssl to perform encryption or decryption operations, exfiltrating sensitive data, or interacting with command and control servers. Monitoring for such sequences can help identify potentially compromised sys