Browse Rules

Suspicious XPC Service Child Process

Detects an abnormal child process of a XPC service running from a suspicious location.

Microsoft Office AddIn Loaded

Detects attempts to load an unsigned executable from known Microsoft Office add-ins directories. Adversaries may leverage Office Addins for persistence.

Image Load via Synthetic Stack Spoofing

Detects attempts to load a networking module from a potentially altered call stack in order to conceal the true source of the call.

Suspicious Execution via Microsoft OfficeCmd URL Handler

Identifies Microsoft Local Bridge executable with suspicious arguments that may indicate an attempt to exploit Microsoft ms-officecmd URL handler via an argument injection vulnerability.

Unsigned File Execution via Network Logon

Identifies the execution of a recently created file that is unsigned or untrusted and from a remote network logon. This may indicate lateral movement via remote services.

Rundll32 or Regsvr32 Loaded a DLL from Unbacked Memory

Identifies instances of RunDLL32 or Regsvr32 loading a DLL from an unbacked memory region. Adversaries often abuse those programs to proxy execution of malicious libraries.

Self Service Persistence by an Unsigned Process

Identifies when a recently dropped unsigned process attempt to register itself to run as service. Adversaries may use services to maintain persistence or run with System privileges.

VSS Service Disabled Followed by a Suspicious File Rename

Identifies changes of the Volume Shadow Service start type to disabled status and subsequently followed by a suspicious file rename operation. This may indicate Ransomware behavior.

DLL Dropped by MSIEXEC followed by SideLoad

Identifies the creation of an unsigned or untrusted DLL and subsequently loaded by a trusted binary. This behavior is consistent with some malwares leveraging malicious Windows installers to sideload malicious DLLs.

Privilege Escalation via NTLMRelay2Self

Identifies attempt to coerce a local NTLM authentication via HTTP using Printer Spooler service as a target. An adversary may use this primitive in combination with others to elevate privileges on a compromised system.

Suspicious ImageLoad via ODBC Driver Configuration Program

Identifies abuse of the ODBC Driver Configuration Program to load an arbitrary DLL. This behavior is used as a defense evasion technique to blend-in malicious activity with legitimate Windows software.

Execution via Suspicious JavaScript Updates

Identifies the execution of a Windows script with a file name following a phishing naming convention commonly used by SocGolish. SocGholish is an initial access threat that leverages drive-by-downloads masquerading as software updates.

Potential DLL SideLoad via a Microsoft Signed Binary

Identifies attempts to load an unsigned DLL from a mounted virtual disk (.iso, .vhd) and by a signed Microsoft binary. This may indicate an attempt to sideload a malicious DLL to stealthily execute code.

Chromium Extension Loaded from Unusual Parent

Detects the manual loading of a Chromium extension from an unusual parent process. This activity is suspicious and could be indicative of a malware loading a malicious extension to persist or collect browsing secrets such as cookies, browsing history.

Windows Console Execution from Unbacked Memory

Identifies the creation of a Windows console host process where the creating thread's stack contains frames pointing outside any known executable image. This may be indicative of the use of a built-in Windows shell from an injected process.

File Made Executable via Package Install Script

Detects when a file in a suspicious file path is made executable via the chmod binary immediately after an installer pkg is executed via the postinstall script. This is not a common occurrence and indicates the installation of a malicious binary.

Potential Evasion via Oversized Image Load

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations

Kernel Driver Registered via NtLoadDriver

Adversaries may load a driver to a compromised machine to execute code in kernel mode. A majority of legitimate kernel driver installations involve a new service creation via the Windows Service Control Manager (SCM) which generate audit logs. Adversaries can leverage the undocumented Windows API NtLoadDriver to load a driver directly, avoiding service creation traces.

Hidden Payload Executed via Scheduled Job

This rule detects hidden executables being executed through cron and systemd. Cron and Systemd can be used to schedule jobs (commands or scripts) to run periodically at fixed times, dates, or intervals. Threat actors may abuse these built-in services to execute malicious commands or scripts at specific times or intervals to establish persistence or escalate privileges.

Suspicious PrivilegedHelperTool Activity

Detects the potential abuse of a PrivilegedHelperTool by triggering on the execution of specific system binaries where the parent process is a privilegedhelpertool. This activity is not normal or common and could indicate a privilegedhelpertool exploitation bypass attempt. PrivilegedHelperTools are sometimes targeted via injection and XPC manipulation to bypass macOS security controls in order to elevate privileges, establish privileged persistence, or execute commands as a privileged user.

In-Memory JXA Execution via ScriptingAdditions

Detects the potential in memory load of a JXA script. JXA allows users to control applications and the operating system using the JavaScript language. Additionally, it can be leveraged in OSAKit from within other macho binaries without spawning the osascript binary. Malicious payloads will use OSAKit to load JXA (.js) scripts into their process memory allowing them to execute post exploitation tasks from memory without being detected. When OSAKit is utilized to load JXA scripts into memory Apple