Browse Rules

Suspicious Remote Memory Allocation

Identifies attempts to allocate remote memory with RWX permissions, this behavior is often associated with remote process injection preparation.

Potential Evasion via Inline Execute Assembly

Identifies attempts to load the Microsoft Common Language Runtime from a suspicious memory followed by an egress network connection.

Disabling Hypervisor-protected Code Integrity via Registry

Identifies registry modifications to disable Hypervisor-protected Code Integrity. HVCI enforces code integrity in the kernel and allows only signed code to be executed.

Execution from a Password Protected Self Extracting Archive

Identifies the execution of a file from a password protected self-extracting archive. Adversaries may encapsulate malicious code in a protected archive to potentially bypass security controls.

Potential Virtual Machine Fingerprinting via VMDetect

Identifies the use of VMdetect utility to avoid execution on Malware sandboxes and virtual machines. An adversary may attempt to get detailed information about the operating system and hardware.

Persistence via AutodialDLL Registry Modification

Identifies the modification of the WinSock2 AutoDial registry value to potentially maintain persistence via a malicious DLL that get loaded by any processes invoking the Winsock 2 library (ws2_32.dll).

Process Creation with Unusual Mitigation

Identifies attempts to create a process with Microsoft mitigation policy set prevent loading non Microsoft signed DLLs. Adversaries may abuse this feature to prevent loading Endpoint security DLLs that lacks this code signing requirement.

Execution of Non-Executable File via Shell

Detects the execution of an un-executable file, per file extension, via a shell interpreter. Sometimes threat actors will masquerade their payloads as non-executable files in order to avoid suspicion and go unnoticed.

Potential Evasion via dotNET Framework Installation Utility

The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies. Adversaries may abuse this utility to run malicious code.

Scheduled Task from a Removable or Mounted ISO Device

Identifies a process running from a mounted ISO or USB device or its descendants creating a new scheduled task for persistence. Adversaries may use this technique to maintain persistence on an endpoint.

Keystrokes Input Capture from Suspicious CallStack

Identifies attempts to enumerate the state of keyboard keys and the call is coming from a suspicious call stack. Adversaries may log user keystrokes to intercept credentials or other information from the user as the user types them.

Persistence via a Process from a Removable or Mounted ISO Device

Identifies a process running from a mounted ISO or USB device writing to commonly abused persistence locations (registry run keys and startup folder). Adversaries may use this technique to maintain persistence on an endpoint.

Image Hollow from Unusual Stack

Identifies attempt to modify the content of a loaded module and from a suspicious call stack. This may indicate an attempt to inject code using module stomping or DLL hollowing via overwriting the content of a legit DLL with malicious code.

Unsigned or Untrusted Process Execution and Immediate Self-Deletion

Detects when a process executes and then immediately deletes itself (the file on disk). Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

Suspicious File Dropped by a Macro Enabled Document

Identifies when a Microsoft Office process writes an executable file type and from a call stack pointing to Microsoft Office Visual Basic for Applications modules. This may indicate an attempt to get initial access using malicious macro enabled documents.

Module Stomping from a Copied Library

Identifies the load of a library that was recently copied and with a unusual memory allocation properties. This may be the result of a code injection using module stomping or DLL hollowing via overwriting the content of legit DLL with malicious code.

Suspicious File Overwrite and Modification via Echo

Detects the abnormal use of the echo command via a shell to write text into a file located in a suspicious location. Threat actors have used this as a method for creating second stage payloads on systems after initial access has been achieved.

Suspicious Child Process Execution via Interactive Shell

Detects when a process is executed via an interactive shell. C2 platforms will commonly spawn an interactive shell providing the threat actor with a remote shell on the system as if they were physically at the terminal allowing them to send and execute commands manually.

Powershell Encoded Command

Detects process events where the process is Powershell (pwsh) or a shell interpreter (sh, bash, zsh) with the encoded command flag set in the process arguments. Powershell usage on macOS is extremely rare but usage of Powershell with the encoded command flag, used for executing base64 encoded command strings, is almost always inherently malicious.

Shell Script Execution from abnormal Volume Mount Path

Detects the suspicious execution of a shell script from a volume mount path and outside of the standard macOS binary execution path (/Volumes/name.app/Contents/MacOS/binary). This activity is highly abnormal and should indicate potentially malicious activity. Threat actors have used shell scripts like this in order to download additional tools/payloads and prepare the system for post-infection actions by establishing persistence, altering file attributes and creating necessary directories.

Privilege Escalation via Windows Installer Hijack

Identifies the creation or modification of a Windows Installer rollback script (rbs) by an unusual process followed by the execution of process as SYSTEM. rbs files instruct the MSI service to rollback all the modification in the case of a failed installation. This behavior can be abused by an adversary to replace a legit rbs file with a rogue one via a file system oplock and race condition, then triggering an MSI rollback operation leading potentially to a privilege escalation.