Browse Rules

Suspicious API Call from a PowerShell Script

Detects PowerShell scripts calling dual-purpose Win32 APIs.

Potential VSingle Malware Infection

Identifies the execution traces of the Vsingle malware. Vsingle is a Linux trojan that attempts to retrieve C2 servers information from GitHub.

Suspicious DLLRegisterServer Execution via MSIEXEC

Identifies the execution of the built-in Windows Installer, MSIEXEC, to execute code via calling the exported function DLLRegisterServer from a suspicious module.

Suspicious Image Load via LdrLoadDLL

Identifies the load of a library by calling directly the LdrLoadDLL windows API and from a memory allocation with suspicious properties. This could be the result of a process code injection.

Execution via Microsoft Excel XLL Add-In

Identifies attempt to execute and load an unsigned Microsoft Excel XLL Addin. This may indicate an attempt to get initial access via a malicious phishing Microsoft Office Excel Add-In.

Uncommon Persistence via Registry Modification

Detects changes to registry persistence keys that are not commonly used or modified by legitimate programs. This could be an indication of an adversary's attempt to persist in a stealthy manner.

Execution of a Binary Dropped via Microsoft BSDTAR Archive Tool

Identifies the execution of a PE File that was written by the Windows native TAR utility. Adversaries may compress malicious content to bypass existing ingress tool transfer restrictions.

Unusual Process Running as Antimalware Protected

Identifies when commonly abused signed binaries are running as Antimalware Light protection level. This may indicate an attempt to bypass PPL protection and inject malicious code into a protected process or disable security software.

Suspicious Script Execution via VBSEdit Launcher

Identifies the execution of a Script via VbsEdit Script Launcher utility and from unusual path. Malware may abuse this legit utility to bypass security solutions monitoring malicious scripts execution via the Windows built-in Script interpreters (cscript or wscript).

Suspicious Execution via Compiled HTML File

Identifies when the Microsoft HTML Help Executable (hh.exe) spawn a suspicious child process or open a compiled HTM file from a suspicious location. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution.

Linux Suspicious Child Process Execution via Interactive Shell

Detects when a process is executed via an interactive shell. C2 platforms will commonly spawn an interactive shell providing the threat actor with a remote shell on the system as if they were physically at the terminal allowing them to send and execute commands manually.

Rundll32 or Regsvr32 Executing an OverSized File

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations

Execution of a File Dropped by OpenSSL

Identifies when the OpenSSL utility creates a file followed by its execution. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.