Browse Rules

Elastic Endpoint Security Kernel Extension Unload

Identifies attempts to unload the Elastic Endpoint Security kernel extension via the kextunload command.

Office Application Startup via Template File Modification

Adversaries can modify default Microsoft Office templates in order to establish persistence using malicious Macro templates.

Remote Thread Context Manipulation

Identifies potential remote process manipulation using SetThreadContext API. This may indicate an attempt to inject code or debug a remote process.

Scriptlet Execution via Rundll32

Identifies when scrobj.dll is loaded into rundll32.exe. An adversary may abuse rundll32.exe to proxy execution of malicious code.

Execution of a Windows Script Downloaded via a LOLBIN

Identifies when a Windows script interpreter executes a file downloaded via commonly abused legit Windows binaries such as Certutil or BitsAdmin.

Sensitive File Access - Unattended Panther

Identifies an unusual process accessing Windows Panther Installation files. Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.

Windows Script Execution from Archive File

Identifies the execution of a Windows script from an archive file, mounted ISO or IMG path. Adversaries may use this technique to deliver malicious scripts.

NetWire RAT Registry Modification

Identifies registry modification activity consistent with the NetWire Remote Access Trojan (RAT). NetWire is a publicly available, multi-platform RAT that is used by criminal and APT groups.

Suspicious Execution via Script Editor

Identifies when the macOS Script Editor utility spawns an unusual child process, this may indicate an attempt to execute a malicious Apple Script via a malicious applescript URL handler.

UAC Bypass via Unsafe Deserialization in Event Viewer

Identifies attempts to bypass User Account Control (UAC) via Unsafe .Net Deserialization in Windows Event Viewer. Attackers bypass UAC to stealthily execute code with elevated permissions.

Potential Privilege Escalation via DLL Redirection

Identifies attempts to load a module by a SYSTEM process and via side by side DLL redirection. This may indicate an attempt to elevate privileges via DLL search order hijacking.

Sensitive File Access - System Admin Utilities

Identifies an unusual process accessing common third party system utilities sensitive files and registries. Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.

Suspicious Shell Extension Handler Registry Modification

Identifies registry modification consistent with the SolarMarker Backdoor installer that registers a rogue custom shell extension handler which runs a PowerShell command when a file with a matching extension is opened.

RunDLL32/Regsvr32 Loads a DLL Downloaded via BITS

Identifies when RunDLL32 or Regsvr32 loads an executable downloaded via Microsoft BITS Jobs. An adversary may leverage this technique to avoid suspicious processes making network connections and executing a malicious DLL.

Suspicious Java Execution via a Windows Script

Identifies when a Java archive is executed via a Windows Script. This may indicate an attempt to bypass application whitelisting by delivering malicious JAR file via a malicious Windows Jscript or Vbscript.

Script File Written by Microsoft Office Process

Identifies the execution of a script file written by a Microsoft Office application (Word, PowerPoint, or Excel). Script interpreters are often launched during exploitation of Office applications or from documents containing malicious macros.

Potential Credential Access via Windows Credential History

Identifies an unusual process accessing Users Windows Credential History File. The CREDHIST file contains previous password related master key hashes used by Microsoft's DPAPI. Adversaries may acquire credentials from the Windows Credential Manager.

AMSI or WLDP Bypass via Memory Patching

Identifies attempts to modify the permissions or write to Microsoft Anti Malware Scan Interface or Windows Lock Down Policy related DLLs from memory. This may indicate an attempt to tamper with certain Windows native protections.

Potential Masquerading as Windows Error Manager

Identifies suspicious instances of the Windows Error Reporting process (WerFault.exe or Wermgr.exe) with matching a suspicious parent call stack. This may be indicative of a masquerading attempt to evade suspicious child process behavior detections.

Suspicious Access to Windows Vault Files

Identifies an unusual process accessing Windows Vault files. Credential Lockers store credentials in encrypted .vcrd files and the encryption key can be found in a file named Policy.vpol. Adversaries may acquire credentials from Vault files.

File Execution via Microsoft HTML Help

Identifies when the Microsoft HTML Help Executable (hh.exe) creates a portable executable (PE) file and the file is subsequently executed. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution.

Suspicious Execution via ShellBrowserWindow/ShellWindow COM

Identifies suspicious access to the ShellBrowserWindow or ShellWindow COM objects by a Microsoft Office process followed by the execution of commonly abused signed proxy binary. This may indicate an attempt to avoid triggering a suspicious process tree using malicious phishing documents.

Dumping Account Hashes via Built-In Commands

Identifies the execution of macOS built-in commands used to dump user account hashes. Adversaries may attempt to dump credentials to obtain account login information in the form of a hash. These hashes can be cracked or leveraged for lateral movement.

Potential NTDLL Memory Unhooking

Identifies the load of NTDLL for the second time and followed by another activity from a call stack with a modified NTDLL memory section. This may indicate an attempt to patch or modify the NTDLL memory region to evade endpoint security solutions hooking Windows APIs.

Decoded or Decrypted Payload Written to Suspicious Directory

Identifies when the openssl utility is used to decode and/or decrypt a payload and write it to an abnormal or suspicious directory. Malware authors may attempt to evade detection by encoding and/or encrypting their payload. This behavior is consistent with the Bundlore malware family.