Browse Rules

Empire Stager Execution

Identifies when a script interpreter executes a base64-encoded Empire stager. Empire is penetration testing software that is often utilized by attackers.

UAC Bypass via Sdclt

Identifies attempts to bypass User Account Control (UAC) via sdclt.exe. Attackers bypass UAC to stealthily execute code with elevated permissions.

Execution from Suspicious Directory

Identifies process execution from directories that are often abused by malware such as roaming, public and programdata folders followed by a DNS lookup request.

UAC Bypass via WSReset Execution Hijack

Identifies attempts to bypass User Account Control (UAC) via WSReset execution hijack. Attackers bypass UAC to stealthily execute code with elevated permissions.

Suspicious Windows Service Execution

Identifies the execution of a Windows service from suspicious path such as mounted localhost admin share. This may indicate an attempt to elevate privileges via windows services.

Failed Attempts to Access Sensitive Files

Identifies failed attempts to access common sensitive files and registries. Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.

Remcos RAT Registry or File Modification

Identifies registry and file system activity consistent with the Remcos Remote Access Trojan (RAT). Remcos RAT is used by attackers to perform actions on infected machines remotely.

CrashDump Disabled via Registry Modification

Identifies attempt to disable memory crashdump via registry modification. Malware using kernel mode component may perform this action to limit exposure in the case of an unexpected system crash.

Inhibit System Recovery via Microsoft Office Process

Identifies the use of Windows commands to tamper with system recovery settings via Microsoft Office processes. Ransomware and other malware may do this to prevent system recovery.

Inhibit System Recovery Followed by a Suspicious File Rename

Identifies the execution of Windows utilities to tamper with system recovery settings and subsequently followed by a suspicious file rename operation. This may indicate Ransomware behavior.

Network Connection via Startup Item

Identifies the execution of an unsigned program or script from the Startup shell folder followed by an immediate network connection. This may indicate the presence of a malicious persistent item.

Suspicious Apple Script Execution

Identifies the execution of the Apple script interpreter (osascript) process with suspicious command line arguments. This behavior is consistent with an attacker executing malicious scripts for execution or command and control.

UAC Bypass Attempt via Windows Directory Masquerading

Identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory. Attackers may bypass UAC to stealthily execute code with elevated permissions.

Control Panel Process with Unusual Arguments

Identifies instances of the Control Panel application running with suspicious keywords or paths in the process command line value. Adversaries may abuse Control.exe to proxy execution of malicious code.

UAC Bypass via Malicious MMC Snap-In Execution

Identifies attempts to bypass User Account Control (UAC) by executing a malicious Microsoft Management Console (MMC) snap-in. Attackers bypass UAC to stealthily execute code with elevated permissions.

Untrusted Document Opened via Microsoft Office

Identifies the execution of Microsoft Office processes to open a document classified by Microsoft SmartScreen as originating from an unknown source followed by Microsoft Office spawning an unusual child process.

Script Execution via MSXSL

Identifies when a Windows Script module is loaded into the Microsoft Core XML Services (MSXML) process. This may indicate an attempt to bypass application whitelisting by executing a malicious script in a trusted process.

Scriptlet Execution via CMSTP

Identifies when scrobj.dll is loaded into the Microsoft Connection Manager Profile Installer (cmstp.exe) process. This may indicate an attempt to bypass application whitelisting by executing a malicious scriptlet in a trusted process.

Scriptlet Proxy Execution via PubPrn

Adversaries may use the trusted PubPrn script to proxy execution of malicious files. This behavior may bypass signature validation restrictions and application control solutions that do not account for use of these scripts.

Suspicious MS Office Execution via DCOM

Identifies suspicious modification of the Microsoft Office AccessVBOM security setting followed by the execution of another Office process instance via DCOM. This may indicate an attempt to evade detection via suspicious process tree.

Execution via Internet Explorer Exporter

Identifies the execution of the built-in Windows program, ExtExport, which can be used for execution via side-loading a malicious DLL with one of the following names: mozcrt19.dll, mozsqlite3.dll, or sqlite.dll.

Potential DLL Search Order Hijacking of an Existing Program

Identifies attempts to load a recently created unsigned DLL file by an already existing signed process. This may indicate an attempt to load a malicious module via DLL search order hijacking.

Suspicious Automator Workflows Execution

Identifies the execution of the Automator Workflows process followed by a network connection from the XPC service. Adversaries may drop a custom workflow template that hosts malicious JavaScript for Automation (JXA) code as an alternative to using osascript.

Suspicious ImageLoad via Windows Update Auto Update Client

Identifies abuse of the Windows Update Auto Update Client (wuauclt.exe) to load an arbitrary DLL. This behavior is used as a defense evasion technique to blend-in malicious activity with legitimate Windows software.

UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer

Identifies User Account Control (UAC) bypass attempts by abusing an elevated COM Interface to launch a malicious program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions.