Browse Rules

Renamed Third Party Administrator Tools

Identifies third party administrative tools commonly used by adversaries but running with unexpected file names.

Suspicious MsiExec Child Process

Identifies the execution of a suspicious MsiExec child process. Adversaries may abuse Windows Installers for initial access and delivery of malware.

UAC Bypass via FodHelper Execution Hijack

Identifies User Account Control (UAC) bypass via fodhelper.exe execution hijack. Attackers bypass UAC to stealthily execute code with elevated permissions.

UAC Bypass via ComputerDefaults Execution Hijack

Identifies attempts to bypass User Account Control (UAC) via ComputerDefaults execution hijack. Attackers bypass UAC to stealthily execute code with elevated permissions.

Sensitive File Access - Remote Desktop Connection Manager

Identifies an unusual process accessing Remote Desktop Connection Manager settings file. Adversaries may search and steal credentials from administration utilities configuration files.

Registry Persistence via Microsoft Office Descendant Process

Identifies the modification of common AutoStart related registry keys descending from a Microsoft Office process. Adversaries may use this technique to maintain persistence.

UAC Bypass via Windows Activation Execution Hijack

Identifies attempts to bypass User Account Control (UAC) via Windows activation changepk.exe execution hijack. Attackers bypass UAC to stealthily execute code with elevated permissions.

Windows Firewall Exception List Modified via Untrusted Process

Identifies the execution of the built-in Windows program, Netsh, to add a program to the Windows Firewall exception list via an untrusted parent process.

Execution via a Suspicious WMI Client

Identifies the execution of a process via Windows Management Instrumentation (WMI) and with an unusual effective parent. Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.

Execution via Outlook Application COM Object

Identifies the execution of commonly abused utilities to run DLLs or scripts via the Outlook.Application COM Object. This behavior may indicate adversarial activity to evade defenses on the system.

UAC Bypass via Control Panel Execution Hijack

Identifies attempts to bypass User Account Control (UAC) via hijacking the default handler of the Backup and Restore control panel. Attackers bypass UAC to stealthily execute code with elevated permissions.

Potential Library Load via ROP Gadgets

Identifies the load of a library from unusual modules or NTDLL offsets. This may indicate an attempt to bypass API monitoring using Return Oriented Programming (ROP) assembly gadgets to execute a syscall instruction.

Privilege Escalation via Windir or SystemRoot Environment Variable

Identifies a privilege escalation attempt via a rogue Windows directory (Windir) or System Root environment variable. This is a known primitive that is often combined with other vulnerabilities to elevate privileges.

Suspicious Image File Execution Options Modification

The Debugger and SilentProcessExit registry keys can allow an adversary to intercept the execution of files, causing a different process to be executed. This functionality can be abused by an adversary to establish persistence.

Windows Command Shell Spawned via Microsoft Office

Identifies a Microsoft Office application starting a Windows command prompt with suspicious command line arguments. This behavior is consistent with a victim opening a malicious document and executing an attacker's malicious code.

Microsoft Office Loaded a Dropped Executable File

Identifies when a Microsoft Office process creates an executable file (DLL) and the file is subsequently loaded. An adversary may deliver a weaponized Office document to their target that writes and loads malicious modules.

Inhibit System Recovery via Obfuscated Commands

Identifies the execution of Windows utilities to tamper with system recovery settings. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system and prevent recovery.

Inhibit System Recovery via Untrusted Parent Process

Identifies the execution of Windows utilities to tamper with system recovery settings. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system and prevent recovery.

Payload Decoded and Decrypted via Built-In Utilities

Identifies when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.