Browse Rules

Encoded Powershell Execution via MsiExec

Detects attempts to execute encoded powershell commands via Windows Installers.

Execution via Interactive Secondary Logon

Identifies suspicious execution via interactive logon using the seclogon service.

Suspicious Antivirus Registration

Identifies attempts to disable Windows Defender via registering a rogue anti-virus.

Killall Execution via Python

Detects when Python executes the Killall binary in order to kill a process.

Execution via MsiExec DownloadAndExecute CustomAction

Detects attempts to download and execute a file via a Windows Installer CustomAction.

Ingress Transfer via Windows Utility

Identifies attempt to download remote content by commonly abused ingress tool transfer binaries.

Python Outbound Network Connection over FTP

Detects when Python executes and immediately makes an outbound network connection over FTP.

Elastic Endpoint Security Kernel Extension Unload

Identifies attempts to unload the Elastic Endpoint Security kernel extension via the kextunload command.

Powershell Execution via Named Pipe

Identifies the execution of a PowerShell script that allow remote command execution via named pipe.

Renamed Third Party Administrator Tools

Identifies third party administrative tools commonly used by adversaries but running with unexpected file names.

Shellcode Allocation from Free Memory

Identifies when a process attempts to allocate shellcode from a memory region marked as free.

Untrusted File Execution via Microsoft Office

Identifies the execution of an unsigned file written or modified by Microsoft Office processes.

Network Activity from Modified Module

Identifies network activity from a module modified in memory. This may indicate a successful module stomping attack.

Command Shell Activity Started via RunDLL32

Identifies command shell activity started via RunDLL32, which is commonly abused by attackers to host malicious code.

Domain Accounts Enumeration via LDAP Search

Identifies a list of suspicious LDAP queries often used by reconnaissance tools to enumerate domain user accounts.

Execution from Suspicious Stack Trailing Bytes

Identifies execution behavior from known malware or testing tools based on known call stack trailing bytes patterns.

Office Application Startup via Template File Modification

Adversaries can modify default Microsoft Office templates in order to establish persistence using malicious Macro templates.

Password Spraying Enumeration via LDAP

Identifies a list of common LDAP search queries used to gather candidate accounts before launching password spraying attacks.

Remote Access to Sensitive Registry Keys

Identifies attempts to query remotely sensitive registry keys containing different credential materials via the remote registry service.

Suspicious Microsoft IIS Worker Descendant

Identifies suspicious child processes of Microsoft IIS Worker process which may suggest a vulnerability and remote webshell access.

Windows Socket Creation from Unbacked Memory

Identifies the creation of a Windows network socket from unbacked memory, this may indicate process code injection.

Suspicious Image Load from a Stomped Module

Identifies potential traces of module stomping where a Windows library is loaded from a suspicious call stack.

Suspicious Memory Mapping from a Windows Installer

Identifies suspicious API calls from a Windows Installer module. This behavior is consistent with code injection attacks.

Empire Stager Execution

Identifies when a script interpreter executes a base64-encoded Empire stager. Empire is penetration testing software that is often utilized by attackers.

Outlook Home Page Registry Modification

Identifies modifications in registry keys associated with abuse of the Outlook Home Page functionality for command and control or persistence.