Browse Rules

Suspicious Microsoft IIS Worker Descendant

Identifies suspicious child processes of Microsoft IIS Worker process which may suggest a vulnerability and remote webshell access.

Suspicious DNS Query from Mounted Virtual Disk

Identifies DNS queries to commonly abused legit web services by a process running from a mounted virtual disk (.iso, .vhd).

Execution of a Windows Script with Unusual File Extension

Identifies the execution of a script with an unusual file extension by Windows Script Host processes (cscript or wscript).

Microsoft Office Process Setting Persistence via Startup

Identifies files written to or modified in the startup folder by a Microsoft Office process. Adversaries may use this technique to maintain persistence and avoid spawning suspicious child processes.

Potential Parent Process PID Spoofing via MalSecLogon

Identifies potential parent process spoofing via abusing the seclogon service. Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges.

Script Interpreter Process Writing to Commonly Abused Persistence Locations

Identifies a Windows script interpreter writing to two persistence locations (registry run keys and startup folder). Adversaries may use this technique to maintain multiple methods of persistence on an endpoint.

Unusual Startup Shell Folder Modification

Identifies suspicious startup shell folder modifications. An adversary may attempt to change the default startup directory in order to bypass detections that monitor for suspicious file creation events in the default Windows Startup folder.

Renamed Windows Automaton Script Interpreter

Identifies suspicious execution of commonly abused third party Windows automation script interpreters. Attackers may rename AutoHotKey, Rebol or KIXTART executable files or execute scripts from suspicious paths in an attempt to avoid signature-based detection.

Execution of Commonly Abused Utilities via Explorer Trampoline

Identifies the execution of commonly abused utilities to run DLLs or scripts via a separate Windows Explorer trampoline. Explorer can be abused to launch malicious scripts or executables from a trusted parent process.

Execution via Electron Child Process Node.js Module

Identifies attempts to execute a child process from within the context of an Electron application using the child_process Node.js module. Adversaries may abuse this technique to inherit permissions from parent processes.

Suspicious Windows Service DLL Creation

Identifies the creation of a new service via ServiceDLL registry modification instead of using the Windows Service Control Manager APIs, subsequently loaded by svchost.exe. Adversaries may use this technique to maintain persistence or run with System privileges.

ImageLoad of a File dropped via SMB

Identifies the transfer of a library via SMB followed by loading it into commonly DLL proxy execution binaries such as rundll32, regsvr32 and shared services via svchost.exe. This may indicate an attempt to remotely execute malicious code.

Potential Privilege Escalation via TCC bypass with fake TCC.db

Identifies the creation of an alternate or fake TCC database potentially containing rogue macOS privacy preferences. The creation of another TCC database should not occur normally in any circumstance and should be considered highly suspicious.

Suspicious Shortcut Modification

Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.

Unusual Child Process Integrity Level

Identifies the execution of a process with an integrity level of SYSTEM from a parent process with an integrity level of Low or Medium. This behavior is consistent with a successful exploit to escalate privileges and create a process with SYSTEM privileges.

Registry Run Key Prefixed with Asterisk

Run and RunOnce registry keys cause programs to run each time that a user logs on. By default, these keys are ignored when the computer is started in Safe Mode. The value name of RunOnce keys can be prefixed with an asterisk (*) to force the program to run even in Safe Mode. Attackers have been observed in the wild using this technique to execute ransomware in Safe Mode.