Browse Rules

Unusual PowerShell Engine ImageLoad

Identifies the PowerShell engine being invoked by unexpected processes. Instead of executing PowerShell functionality with powershell.exe, some attackers do this to operate more stealthily.

Regsvr32 with Unusual Arguments

Identifies unusual instances of Regsvr32 with suspicious keywords or paths in the process command line value. Adversaries may abuse regsvr32.exe to proxy execution of malicious code.

Sensitive File Access - SSH Saved Keys

Identifies an unusual process accessing common SSH clients saved SSH keys. Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.

Suspicious Microsoft Office Child Process

Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, Excel). These child processes are often launched during exploitation of Office applications or from documents with malicious macros.

Web Browser Credential Access via Unsigned Process

Identifies an unsigned process accessing the password store of commonly used web browsers. Adversaries may steal credentials from web browsers by reading files specific to the target browser.

External IP Address Discovery via a Trusted Program

Identifies scripting utilities and commonly abused binary proxy programs making a DNS request to a known public IP address lookup web service. Malwares tend to perform this action to assess potential targets.

NTDLL Loaded from an Unusual Path

Identifies when a process loads the Windows NTDLL image from an unusual path. This may be indicative of adversarial attempt to evade NTDLL syscall hooking by loading a clean (unhooked) copy of the same image.

Unexpected SMB Connection from User-mode Process

Identifies unexpected processes making network connections over port 445. Windows File Sharing is typically implemented over Server Message Block (SMB), which communicates between hosts using port 445. When legitimate, these network connections are established by the kernel. Processes making 445/tcp connections may be port scanners, exploits, or suspicious user-level processes moving laterally.

Reflective Dylib Load

Detects the potential loading of a dylib from memory by looking for dylib load events without a dll.path present indicating the dylib was not loaded from disk. Loading a dylib directly into memory is a technique often used by attackers to evade detection. This is because loading a dylib directly into memory leaves no traces on the disk, making it harder for security tools or analysts to detect the malicious dylib.

Suspicious Network Connection via Installer Package

Detects the execution of a MacOS installer package with an abnormal child process (e.g bash) followed immediately by a network connection via a suspicious process (e.g curl). Threat actors will build and distribute malicious MacOS installer packages, which have a .pkg extension, many times imitating valid software in order to persuade and infect their victims often using the package files (e.g pre/post install scripts etc.) to download additional tools or malicious software. If this rule fires i