Browse Rules

Suspicious Vault Client Image Load

Identifies when the Credential Vault Client library is loaded by an unusual process. Adversaries may acquire credentials from Vault files.

Unusual Network Connection via RunDLL32

Identifies unusual instances of rundll32.exe making outbound network connections. This may be indicative of adversarial command and control activity.

Suspicious Access to Active Directory Database File

Identifies access to the Active Directory Domain Database file (ntds.dit). This file contains sensitive information including hashed domain credentials.

Suspicious Cmd Execution via WMI

Identifies suspicious command execution (cmd) via Windows Management Instrumentation (WMI) on a remote host. This could be indicative of adversary lateral movement.

Suspicious Windows Script Process Execution

Identifies the execution of a Windows scripting interpreter with suspicious process arguments such as unusual script engine or unusual process working directory.

Privilege Escalation via Named Pipe Impersonation

Identifies a privilege escalation attempt via named pipe impersonation. An adversary may abuse this technique by utilizing a framework like Metasploit's getsystem command.

Binary Proxy Execution via Rundll32

Identifies the execution of a malicious application via rundll32.exe. Adversaries may abuse rundll32.exe to proxy execution of malicious code and bypass application whitelisting configuration.

Sensitive File Access - Cloud Credentials

Identifies an unusual process accessing common cloud providers credential files. Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.

Registry Modification via Microsoft Office

Identifies modification of common autostart related registry keys by a Microsoft Office process. Adversaries may use this technique to maintain persistence and avoid spawning suspicious child processes.

Execution of a File Dropped from SMB

Identifies the execution of a file that was created by the virtual system process and subsequently executed. This may indicate lateral movement via network file shares.

Suspicious Bitsadmin Activity

Identifies downloads, transfers, or job creations using Windows Background Intelligent Transfer Service (BITS) Admin Tool. This tactic may be indicative of malicious activity where malware is downloading second stage payloads using obscure methods.

Connection to Dynamic DNS Provider by a Signed Binary Proxy

Identifies DNS queries to known Dynamic DNS Providers by a signed Microsoft binary execution proxy. Dynamic DNS providers are often misused to host malware Command and Control servers.

Driver Dropped by Untrusted Executable

Identifies the creation of a driver file by an untrusted program and subsequently loaded in the kernel. Adversaries may bring a driver onto a compromised machine to execute code with the highest privileges.

Potential Privilege Escalation via Token Impersonation

Identifies the creation of a process running as SYSTEM and impersonating a Windows core binary privileges. Adversaries may create a new process with a different token to escalate privileges and bypass access controls.

Network Connection via Process with Unusual Arguments

Identifies suspicious network connections from Windows processes that typically have more than one command line argument. This may be indicative of a masquerading attempt to evade detections that monitor for suspicious parent-child process relationships.

Startup Persistence via Microsoft Office Descendant Process

Identifies files written to or modified in the startup folder by a Microsoft Office descendant process. Adversaries may use this technique to maintain persistence and to avoid spawning suspicious child processes in an attempt to evade detection.

Potential Decoy Document via User Execution

Identifies the execution of Microsoft Office or Adobe Reader to open a potential decoy document from an untrusted parent process. An adversary may employ this technique to avoid victim suspicion by displaying a legit document after opening a malicious executable or script.

Shell Execution via Windows Shortcut File

Identifies the execution of a script or program extracted from within a Windows shortcut (lnk) file. Adversaries may embed malicious scripts or files in a shortcut file before delivering it to their target in order to trick them into executing the payload.