Browse Rules

Untrusted File Execution via Microsoft Office

Identifies the execution of an unsigned file written or modified by Microsoft Office processes.

Command Shell Activity Started via RunDLL32

Identifies command shell activity started via RunDLL32, which is commonly abused by attackers to host malicious code.

Execution from Suspicious Stack Trailing Bytes

Identifies execution behavior from known malware or testing tools based on known call stack trailing bytes patterns.

UAC Bypass via DelegateExecute Registry Modification

Identifies attempts to bypass User Account Control (UAC) by modifying the DelegateExecute registry value. Attackers bypass UAC to stealthily execute code with elevated permissions.

Suspicious Scheduled Task Creation

Identifies the creation of a scheduled task with suspicious argument such as task path or parent process. This behavior is consistent with an adversary attempting to establish persistence.

Unusual DLL Extension Loaded by Rundll32 or Regsvr32

Identifies instances of RunDLL32 or Regsvr32 loading a DLL with an unusual file extension. Adversaries often abuse those programs to proxy execution of malicious code.

Ingress Tool Transfer via CURL

Identifies downloads of remote content using Windows CURL executable. This tactic may be indicative of malicious activity where malware is downloading second stage payloads using built-in Windows programs.

Execution of a Windows Script File Written by a Suspicious Process

Identifies the execution of a script file written by a suspicious application. Script interpreters are often launched during exploitation of Office applications or from documents containing malicious macros.

Potential Data wiping Attack Behavior

Identifies a suspicious sequence of file modifications where the entropy of the file is set to zero and its original size is still shown as unmodified. This may indicate a data wiping attack behavior.

Suspicious Windows Script File Name

Identifies the execution of a Windows script with a file name following commonly used phishing naming convention via including legit document and image extensions or keywords that may lure a victim user into opening the malicious script.

Suspicious Scheduled Task Creation via Masqueraded XML File

Identifies the creation of a scheduled task using an XML file that does not have a .xml file extension. This behavior is consistent with an adversary attempting to establish persistence in a stealthy manner to evade detection.

Inhibit System Recovery via Windows Command Shell

Identifies the execution of Windows utilities to tamper with system recovery settings. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system and prevent recovery.

Windows Error Manager/Reporting Masquerading

Identifies suspicious instances of the Windows Error Reporting process (WerFault.exe or Wermgr.exe) with matching command-line and process executable values performing outgoing network connections. This may be indicative of a masquerading attempt to evade suspicious child process behavior detections.

UAC Bypass Attempt via CDSSync Scheduled Task Hijack

Identifies attempts to bypass User Account Control (UAC) via CDSSync scheduled task hijack by modifying the system root environment variable leading to loading a malicious npmproxy.dll module. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions.

Potential Privilege Escalation via Elevated IFileOperation

Identifies attempts to elevate privileges by dropping a DLL file via elevated IFileOperation (Rename, Move or Copy) followed by DLL side-loading into a process running with SYSTEM integrity. Attackers may attempt to hijack DLL search order and stealthily execute code with elevated permissions.

Potential Self Deletion of a Running Executable

Identifies the execution of a file followed by the rename of its primary file stream. This may indicate an attempt to delete the currently running process executable file on disk, bypassing the file lock restriction. Adversaries may delete files left behind by the actions of their intrusion activity.

Suspicious Windows Shortcut File Creation or Modification

Identifies when an unusually large Windows Shortcut (LNK) file is created or modified with a suspicious file name. Adversaries may embed malicious scripts or files in a shortcut file before delivering it to their target and tricking them into executing the payload. Adversaries also leverage malicious shortcut files to maintain persistence on an endpoint and ensure that their malicious code is executed when a routine event occurs such as when a user logs in to Windows.