Browse Rules

Attempt to Disable Windows Defender Services

Identifies attempt to stop or disable the Windows Defender services from an unusual parent process.

Potential Defense Evasion via Filter Manager Control Program

Identifies attempt to unload a security driver via the Filter Manager Control Program.

Execution from a Downloaded ISO File

Identifies the execution of a process from a downloaded ISO file. Attacker may abuse ISO files to deliver malicious programs.

Potential Lateral Movement via SMBExec

Identifies suspicious service execution via Windows Command Shell which may indicate lateral movement attempt via known offensive testing tool like SMBExec.

Suspicious Windows Defender Registry Modification

Identifies modifications to the Windows Defender configuration settings via registry changes to disable certain protection features and performed by a suspicious process.

Operating System Security Updates Disabled

Identifies changes to the SoftwareUpdate preferences using the built-in defaults command. Adversaries may abuse this in an attempt to disable security updates.

System BootKey Registry Access

Identifies attempts to read the registry values used to calculate the System BootKey, which adversaries can use to recover passwords and other secrets from the registry.

Potential Execution via ZIPExec

Identifies the execution of file dropped via a compressed file (potentially password protected). This may indicate an attempt to bypass disk-based or anti-malware scanning mechanisms.

Shadow Copy Service Disabled via Registry Modification

Identifies attempt to disable the Windows Shadow Copy service via registry modification. Malware may include this type of suspicious service start changes to decrease system recovery chances.

Suspicious NullSessionPipe Registry Modification

Identifies NullSessionPipe registry modifications that specify pipe names that can be accessed anonymously. This could be indicative of adversary lateral movement preparation by making the added pipe accessible to remote systems.

Potential Privilege Escalation via Root Crontab File Modification

Identifies modifications to the root crontab file. Adversaries may overwrite this file to gain code execution with root privileges by exploiting privileged file write or move related vulnerabilities.

Privilege Escalation via PKEXEC Exploitation

Identifies attempt to exploit a local privilege escalation in polkit pkexec (CVE-2021-4034) via unsecure environment variable injection. Successful exploitation allows an unprivileged user to escalate to the root user.

Suspicious Browser Files Modification

Identifies the modification of commonly used browsers settings via file or registry change. Adversaries may install a rogue browser extension or disable certain browser hardening settings to maintain persistence or evade restrictions.

UAC Bypass Attempt via SilentCleanup Task DLL Search Order Hijacking

Identifies attempts to bypass User Account Control (UAC) via DLL search order hijacking. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions.

Potential Kerberos Attack via Bifrost

Identifies use of Bifrost, a known macOS Kerberos pentesting tool, which can be used to dump cached Kerberos tickets or attempt unauthorized authentication techniques such as pass-the-ticket/hash and kerberoasting.

Indirect Command Execution via ForFiles

Identifies the use of native Windows tool, forfiles to execute a file. Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

Potential Credential Access via Rubeus

Identifies the usage of Rubeus using known malicious command line arguments. Rubeus is a toolset used for a diverse set of Kerberos Abuses and Manipulations like renew, ask, extract, and forge Kerberos Tickets.

Suspicious File Rename by an Unusual Process

Identifies the execution of commonly abused signed proxy execution utilities such as rundll32, regsvr32 and powershell followed by a suspicious file rename operation. This may indicate Ransomware behavior leveraging legit Windows utilities.

Suspicious Control Panel DLL Loaded by Explorer

Identifies DLL load of an unsigned or untrusted Control Panel Item by the Explorer process. Adversaries may load a malicious DLL when Control Panel is executed via setting the CPLs subkey to the payload path.

Potential PlugX Registry Modification

Identifies registry modification that matches on PlugX Trojan known registry configuration patterns such as C&C version, Run key persistence value and internet status on the victim machine. PlugX is a known RAT (Remote Access Trojan) malware family that is around since 2008 and is used as a backdoor to control the victim's machine fully.

Embedded Executable via Windows Shortcut File

Identifies the execution of a an executable extracted from within a Windows shortcut (lnk) file. Adversaries may embed malicious files in a shortcut file before delivering it to their target in order to trick them into executing the payload.

Potential Credential Access via Mimikatz

Identifies the usage of Mimikatz using known malicious command line arguments. Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks.

Potential WizardUpdate Malware Infection

Identifies the execution traces of the WizardUpdate malware. WizardUpdate is a macOS trojan that attempts to infiltrate macOS machines to steal data and it is associated with other types of malicious payloads, increasing the chances of multiple infections on a device.

Suspicious Recursive File Deletion via Built-In Utilities

Identifies suspicious use of the Linux rm command to recursively delete user home files and directories. Certain ransomware families abuse this built-in utility to delete user files and important system files after their encryption process is complete.

Suspicious Windows Component Object Model via DLLHOST

Identifies the instantiation of a registered COM object by classID via DllHost and by an unusual process such as Windows scripts interpreters, recently dropped unsigned executables and common signed proxy binaries like Rundll32. Adversaries may use the Windows Component Object Model (COM) for local code execution, evasion or persistence.