Browse Rules

Shellcode Execution from Low Reputation Module

Identifies attempt to allocate or execute Shellcode from a module with low or unknown reputation.

Suspicious Svchost Registry Modification

Identifies modification of the Windows shared services registry key. Adversaries may use this technique to maintain persistence or run with System privileges.

Browser Native Messaging Registry Modification

Identifies attempts to install a new chromium browser native messaging application via registry change. Adversaries may install a rogue browser native messaging host to maintain persistence.

Suspicious Execution via DotNet Remoting

Identifies suspicious execution via DotNet system runtime remoting to execute malicious assembly via named pipes. This may indicate an attempt to bypass application control via trusted windows binaries.

Sleep Execution from Suspicious Process Path

This rule detects the execution of the sleep command from a world-writeable directory or hidden process executable. Attackers may use sleep to delay execution of malicious code.

Internet Activity from Suspicious Unbacked Memory

Identifies the modification of WinInet registry related keys by a process where the creating thread's stack contains frames pointing outside any known executable image. This may indicate evasion via process injection.

Suspicious Unsigned DLL Loaded by a Trusted Process

Identifies the load of an unsigned or untrusted DLL by a trusted binary followed by loading a networking DLL from unbacked memory region. This may indicate execution via DLL sideloading.

Egress Network Connection from Deleted Executable by Root

This rule detects network connections initiated by a process that has been deleted from the filesystem. This behavior may indicate an attempt to evade detection by removing the malicious executable after execution.

Potential Injection via Module Stomping

Identifies the load of a library with a unusual memory private bytes allocation. This may be the result of a code injection using module stomping or DLL hollowing via overwriting the content of legit DLL with malicious code.

DLL Side Loading of a file dropped by Microsoft Office

Identifies when a Microsoft Office process creates an executable file (DLL) and the file is subsequently loaded by a trusted binary. An adversary may deliver a weaponized Office document to their target that writes and loads malicious modules.

Suspicious Remote Process Suspend Activity

Identifies attempts to suspend a remote process via NtSuspendProcess or a remote thread via SuspendThread and where the target process is not a child process. Adversaries may use this technique to suspend endpoint security processes or hijack the execution flow of a running process.

Network Activity from a Stomped Module

Identifies when a process loads a network library and the thread call stack is pointing to a modified memory module. This may be the result of a code injection using module stomping or DLL hollowing via overwriting the content of legit DLL with malicious code.

Registry or File Modification from Suspicious Memory

Identifies the modification of file or registry to set persistence or evade defense and from a call stack pointing to an unbacked memory region or Microsoft Visual Basics DLLs. Adversaries may use this technique to maintain persistence or evade defense from an injected process.

Suspicious Python Command Execution

This rule monitors for suspicious Python command executions by detecting the start of a Python process with a command line argument that contains keywords commonly used by attackers to execute malicious code. These command line arguments include operations to execute code, create subprocesses, and encode or decode data.

Potential Process Masquerading via Exec

This rule detects process masquerading through the use of the `exec` command. The `exec` command can be used in conjunction with the `-a` flag to change the name of the process in the process table. This technique is used by malware to hide the true identity of a process from security tools and analysts.

Suspicious DMG File Creation in Tmp Directory

Detects the creation of a DMG file in the temp directory. The creation of a DMG file like this has been observed being used to exploit vulnerabilities that allow for mounting over sensitive parts of the filesystem, thereby bypassing certain macOS security controls such as TCC and SIP. This activity is not normal or common and should be considered suspicious.

Tclsh Execution followed by immediate Network Connection

Detects the execution of the tclsh binary followed by an immediate network connection by tclsh linked by the process.entity_id value. Tclsh is a shell-like application that reads Tcl commands from its standard input or from a file and evaluates them. Tcl is a high-level programming language. It is still a default installation as of macOS 12 Monterey, making it an ideal candidate for payload execution.

Driver Load - pskmad_64.sys

Detects loading of driver pskmad_64.sys via name. Panda Kernel Memory Access Driver versions through 1.1.0.21 are affected by CVE-2023-6330, CVE-2023-6331, and CVE-2023-6332. This signed 1.0.0.17 build exposes the \\Device\\PSMEMDriver interface and handles IOCTL 0xB3702C08, which can trigger an out-of-bounds write or disclose arbitrary kernel memory because request data and memory ranges are not adequately validated. The flaws can cause a system crash, leak sensitive kernel data, and may suppor

Driver Load - pskmad_64.sys

Detects loading of driver pskmad_64.sys via hash. Panda Kernel Memory Access Driver versions through 1.1.0.21 are affected by CVE-2023-6330, CVE-2023-6331, and CVE-2023-6332. This signed 1.0.0.17 build exposes the \\Device\\PSMEMDriver interface and handles IOCTL 0xB3702C08, which can trigger an out-of-bounds write or disclose arbitrary kernel memory because request data and memory ranges are not adequately validated. The flaws can cause a system crash, leak sensitive kernel data, and may suppor

Suspicious Terminal Child Process Execution

Detects the execution of a process in a suspicious location by the Terminal application. Terminal will, often times, be granted full disk access by users and administrators who use it. Threat actors are aware of this and will abuse it in order to get their payloads to execute with the same context as Terminal, providing their payload full disk access. They do this by modifying shell profiles (e.g .zshrc, bashrc, etc.) that point to and execute their payload then when Terminal initiates those pro