Browse Rules

Privilege Escalation via SeImpersonatePrivilege

Identifies a privilege escalation attempt from an account with the SeImpersonatePrivilege to full System privileges.

Tampering of Bash Command-Line History

Adversaries may attempt to clear or disable the Bash command-line history in an attempt to evade detection or forensic investigations.

Potential Executable Stored in the Registry

Identifies registry write modifications to hide an encoded portable executable. This could be indicative of adversary defense evasion by avoiding the storing of malicious content directly on disk.

Potential Multi Architecture File Downloads

Identifies the execution of curl, wget or ftpg to download payloads named by architecture type in preparation for execution. This behavior is consistent with Mirai bot deployment shell scripts.

Suspicious ImageLoad via Windows CertOC

Identifies abuse of the Microsoft CertOC utility to load an arbitrary DLL. This behavior is used as a defense evasion technique to blend-in malicious activity with legitimate Windows software.

Microsoft Office Fetching Remote Content

Identifies when Microsoft Office applications (Word, PowerPoint, Excel) download remote html content followed by spawning a child process. This behavior matches with some common exploits leveraging malicious office documents for delivery.

Process Creation via ROP Gadgets

Identifies the creation of a process from unusual modules or NTDLL offsets. This may indicate an attempt to bypass API monitoring using Return Oriented Programming (ROP) assembly gadgets to execute a syscall instruction.

Direct Syscall via Assembly Bytes

Identifies attempts to call a System call directly using assembly instructions and from unusual native system module ntdll. This may indicate the use of direct system calls to evade endpoint security solutions hooking Windows APIs.

Unusual Privilege Escalation to System

Identifies the execution of a process as the SYSTEM account from a parent process not running as SYSTEM. This behavior is consistent with a successful exploit to escalate privileges and create a process with SYSTEM privileges.

DLL Loaded from a Macro Enabled Document

Identifies when a Microsoft Office process loads a DLL and from a call stack pointing to Microsoft Office Visual Basic for Applications modules. This may indicate an attempt to get initial access using malicious macro enabled documents.

Windows API via a CallBack Function

Identifies the call of Memory Windows APIs indirectly via a callback function. This may be the result of an evasion attempt to hide the origin of the API call from the call stack such as unbacked memory region.

Privilege Escalation via Microsoft Exchange DLL Hijacking

Identifies attempts to load a DLL from a hardcoded path by the Microsoft Exchange IIS worker process (w3wp). This may indicate an attempt to elevate privilege via loading a malicious DLL from a path writable by low-privileged users.

Browser Debugging from Unusual Parent

Identifies the execution of a Chromium-based browser with the debugging process argument, which may indicate an attempt to steal authentication cookies. An adversary may steal web application or service session cookies and use them to access web applications or Internet services as an authenticated user without credentials.

Cron Tab Creation or Modification via Shell Command

Detects the creation or modification of cron tabs by a suspicious or malicious process. Cron is one of the most well known persistence mechanisms for macOS. It is a scheduler that allows a user to create a scheduled execution. Threat actors have abused this tool to persist their malware on macOS systems.

Shared Object File Creation and Immediate Preload

Identifies the creation of a new shared object (.so) file followed by a process execution that preloads the newly created shared object using either the LD_PRELOAD or LD_LIBRARY_PATH environment variables. Attackers may leverage this technique to inject malicious code into legitimate processes, thereby enabling stealthy persistence and unauthorized access to the compromised system.

Suspicious Unload of Elastic Agent via Launchctl

Detects the abnormal unload of the Elastic Agent plist via the launchctl system binary. This activity can indicate an attempt to disable or destroy the agent's ability to continuously monitor system activity and may indicate a threat actors attempt to evade defenses and remain undetected or not be recorded while performing actions on their objective.

Dylib Loaded by Process in Suspicious Location

Identifies instances where a dynamic library (dylib) is loaded by a process running from a suspicious or non-standard path on macOS. Threat actors may abuse this technique by using compromised or malicious processes originating from unusual locations to load dylibs for code injection, persistence, or privilege escalation. A dylib loaded from a suspicious process path can indicate that the process itself is malicious, has been tampered with, or is attempting to evade detection by operating from a