Browse Rules

Access to Windows Passwords Vault via Powershell

Identifies access attempt to the Windows Passwords Vault via Powershell commands. Adversaries may acquire credentials from Vault files.

Suspicious NetSupport Execution

Identifies a suspicious execution of NetSupport remote access software from non-default paths, issuing a DNS query to a non-standard NetSupport domain.

Suspicious Execution via a Mounted Image File

Identifies the execution of a process from a mounted image file. Attacker may abuse IMG files to deliver malicious programs.

Suspicious Windows Defender Exclusions Added via PowerShell

Identifies modifications to the Windows Defender configuration settings using PowerShell to add exclusions at the folder directory or process level.

Managed .NET Code Execution via Windows Script Interpreter

Identifies a suspicious managed code hosting process which could indicate code injection or other form of suspicious code execution via Windows scripts.

Untrusted DLL Loaded by a Persistent Program

Identifies the load of an untrusted DLL by a persistent trusted binary. This behavior may indicate that an existing persistent program is sideloading a malicious DLL.

Suspicious NTDLL Image Load

Identifies when a process loads a second copy of Windows NTDLL image. This may be indicative of adversarial attempt to evade NTDLL syscall hooking by loading a clean (unhooked) copy of the same image.

MSBuild with Unusual Arguments

Identifies the execution of the built-in MSBuild utility with a suspicious count of command line arguments (less than three). Adversaries may use MSBuild to proxy the execution of malicious code via a trusted Windows utility.

Sudo Heap-Based Buffer Overflow Attempt

Identifies the attempted use of a heap-based buffer overflow vulnerability for the Sudo binary in Unix-like systems (CVE-2021-3156). Successful exploitation allows an unprivileged user to escalate to the root user.

Suspicious ImageLoad from an ISO Mounted Device

Identifies instances of RunDLL32, Regsvr32 or Odbcconf loading a DLL from a mounted ISO device. Adversaries may deliver a malicious payload via an ISO file and execute it via rundll32.exe, regsvr32 or Odbcconf.

Dynwrapx Image Load via Windows Scripts

Identifies when a Windows script interpreter loads an external library that allow to call Windows API functions from scripts in JScript and VBScript. Malware may abuse this legit capability to interact further with the Operating System.

DARKRADIATION Ransomware Infection

Identifies a file extension used by DARKRADIATION bash ransomware that abuses the openssl utility to encrypt files. Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

Modification of Safari Settings via Defaults Command

Identifies changes to the Safari configuration using the built-in defaults command. Adversaries may attempt to enable or disable certain Safari settings, such as enabling JavaScript from Apple Events to ease the user's browser's hijacking.

Microsoft Common Language Runtime Loaded from Suspicious Memory

Identifies the load of the Microsoft Common Language Runtime DLL CLR.dll from unbacked memory region with suspicious memory allocation properties. This could be the result of attempts to load an assembly from an already injected process.

Suspicious Execution from MSSQL Service

Identifies the execution of suspicious processes from the Windows MSSQL service, this may indicate the use of MSSQL stored procedures such as xp_cmdshell or the exploitation of SQL injection vulnerabilities to execute malicious commands on the host Operating System.

Potential Access to Kerberos Cached Credentials

Identifies the use of the Kerberos credential cache (kcc) utility to dump locally cached Kerberos tickets. Adversaries may attempt to dump credentials to obtain account login information in the form of a ticket. These tickets can be leveraged for lateral movement.

Potential Privacy Control Bypass via Localhost Secure Copy

Identifies use of the Secure Copy Protocol (SCP) to copy files locally by abusing the auto addition of the Secure Shell Daemon (sshd) to the authorized application list for Full Disk Access. This may indicate attempts to bypass macOS privacy controls to access sensitive files.

Web Browsers Password Access via Command Line

Adversaries may collect keychain storage data from a system to in order to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos.

Shlayer Malware Infection

Identifies the execution of curl to download a payload for execution. This behavior is consistent with Shlayer malware. Shlayer is a macOS malware family associated with ad fraud activity. Shlayer masquerades typically as an installer for applications like Adobe Flash Player and executes numerous macOS commands to deobfuscate code and install adware with persistence mechanisms.

Quarantine Attribute Deleted via Untrusted Binary

Identifies a potential Gatekeeper bypass from an unsigned or untrusted binary. In macOS, when applications or programs are downloaded from the internet, there is a quarantine flag set on the file. This attribute is read by Apple's Gatekeeper defense program at execution time. An adversary may disable this attribute to evade defenses.

Unexpected Child Process of macOS Screensaver Engine

Identifies when a child process is spawned by the screensaver engine process, which is consistent with an attacker's malicious payload being executed after the screensaver activated on the endpoint. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated.