Browse Rules

Suspicious Python Script Interpreter

Identifies the execution of a recently dropped executable that loads python libraries to interact with Windows APIs.

Unusual LDAP Client Process

Identifies an unusual Windows native process performing LDAP activity. This may indicate an attempt to perform domain discovery using the LDAP protocol.

Defense Evasion via Registry Modification

Identifies modifications to some Windows security related configurations settings via registry changes to disable certain protection or hardening features and performed by a suspicious process.

Suspicious Python Package Child Process Execution

Detects the suspicious execution of a suspcious process by a Python package. This activity could indicate the existence of a malicious Python package installed on the system.

Suspicious Image Load via Windows Scripts

Identifies when a Windows script interpreter loads an unsigned or untrusted external library. This may indicate an attempt to evade detection by executing malicious code via uncommon methods.

Execution of a DNGUard Protected Program

Identifies when a program is loading DNGUard DLL (DNGuard HVM is a .NET obfuscator and code protector), this may indicate an attempt to bypass static detection by obfuscating malicious code.

Potential Injection via DotNET Debugging

Identifies creation of a process and from a call stack that refers to dotnet debugging API OpenVirtualProcess. This may be the result of a code injection attempt using .NET debugging capabilities.

DLL Execution via Visual Studio Live Share

Identifies the use of the Windows Visual Studio Live Share binary to load a random DLL. Adversaries may leverage this utility to execute malicious code via a trusted Microsoft program.

Library Loaded via a CallBack Function

Identifies the load of library from via a callback function. This may be the result of an evasion attempt to hide the origin of the LoadLibrary call from the call stack.

LSA Dump via Windows Error Reporting

Identifies the creation of LSASS memory crash dump via an unusual parent process. Adversaries may abuse the Windows Error Reporting service to proxy LSASS dumping as a preparation for credential access.

Oversized DLL Creation followed by SideLoad

Identifies the creation of an unsigned or untrusted large DLL and subsequently loaded by a trusted binary. This behavior is consistent with some malwares leveraging malicious DLLs for evasion and execution.

Potential DLL Hijacking via Environment Paths

Identifies attempts to load an unsigned DLL from Microsoft default environment paths and by a Microsoft signed binary. This may indicate an attempt to elevate privilege or persist via DLL Search Order Hijacking.

Suspicious Image Load from SMB Shares

Identifies the load of a DLL from a network file share followed by a suspicious DLL load event. Adversaries may leverage this technique to avoid dropping to disk the malicious payload on the targeted machine.

Potential SIP Bypass via the ShoveService

Identifies the use of the Shove service to modify a SIP protected resource. A malicious application may be able to modify protected parts of the file system by spawning the shov process with the -X|x options (used to communicate with the system XPC service and removed by Apple in recent versions).

Potential Process Creation via Direct Syscall

Identifies the creation of a process with parent call stack not starting with Windows NT syscall DLLs such as ntdll and win32u. This may indicate the use of direct system calls to evade endpoint security solutions hooking Windows APIs.

Potential Execution via Shortcut Modification

Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.

Suspicious macOS Application Hidden Executable File

Detects the modification or rename of a hidden executable file in a macOS applications support directory, which contains configuration and resource data for the app. This activity is highly abnormal and could indicate a malicious application or application component such as a 3rd party library.

Timestomping Detected via Touch

This rule detects the use of the `touch` command to modify file timestamps. Attackers may use timestomping to manipulate file timestamps to evade detection and alter the file's appearance. For example, attackers may change the file's creation, modification, and access times to hide malicious activities or make the file appear legitimate.

At Job Creation or Modification via Shell Command

Detects the creation or modification of an At job by a suspicious process. This activity should almost never take place as Apple is slowly deprecating it and atrun execution is disabled by default. If this rule fires it should indicate highly abnormal or malicious activity. Threat actors can abuse the atrun scheduler to persist their binaries on a system.

Execution of Memory File Descriptor via Interactive Session

Detects when a file descriptor in the proc (temporary) file system is executed via an interactive session. This activity indicates an active attempt to execute an in-memory file and should be considered highly abnormal or suspicious. This activity can occur when the memfd syscall is utilized to create a memory resident file, like a payload, and then execute it via command and control.