Browse Rules

Powershell Execution via Runscripthelper

Detects attempts to execute a powershell script bypassing constrained language mode using the RunScriptHelper utility.

Shellcode Behavior from Unusual Memory

Identifies when a process attempts to allocate shellcode from a memory with unusual properties.

Suspicious Execution via SQL PowerShell

Detects attempts to execute suspicious powershell commands using the Microsoft SQL Powershell Helper Tools.

Execution via DCOM Excel Application

Identifies suspicious execution via Distributed Component Object Model service to launch an application via Excel.

Suspicious PowerShell Execution via Windows Scripts

Identifies suspicious PowerShell execution spawning from Windows Script Host processes (cscript or wscript.exe).

Domain Computers Enumeration via LDAP Search

Identifies a list of suspicious LDAP queries often used by reconnaissance tools to enumerate domain computers.

Potential DLL Hollowing from a Writable Image

Identifies attempts to stealthily execute malicious code using DLL hollowing technique from a writable image.

PowerShell Obfuscation Spawned via Microsoft Office

Identifies a Microsoft Office application (Word, PowerPoint, Excel) starting Windows PowerShell with a suspicious command line.

Hollow Image Behavior via Native API

Identifies attempt to perform code injection via image hollowing replacing image mapped memory content with malicious one.

Suspicious DNS Query by MSIEXEC

Identifies DNS queries by MSIEXEC to suspicious DNS domains related to potentially unwanted software delivered via Windows installers.

API Call via Timer Callback Event

Identifies API calls via timeSetEvent callback function. This may indicate an attempt to proxy API call via callback.

Execution from Unusual Directory

Identifies process execution from suspicious default Windows directories. This may be abused by adversaries to hide malware in trusted paths.

Potential privilege escalation via CVE-2022-38028

Identifies a privilege escalation attempt via exploiting CVE-2022-38028 to hijack the print spooler service execution.

Potential Reverse Shell Activity via Terminal

Identifies the execution of a shell process with suspicious arguments which may be indicative of reverse shell activity.

Tccutil Reset via Suspicious Binary

Detects when Tccutils is used to reset the TCC database decisions for a specific service via a suspicious binary.

Bind Shell via Socket

Detects the creation of a bind shell via socket. Attackers may spawn bind shells to establish persistence onto a target system.

Shellcode Fluctuation via CallBack

Identifies private (JIT) code memory with fluctuating page protections. This may indicate an attempt to hide injected code from memory scanners.

Suspicious Trend Micro Security Agent Child Process

Detects a suspicious child process of the Trend Micro Security Agent indicating a possible remote code execution attempt.

Suspicious Execution via DCOM

Identifies suspicious execution via the Distributed Component Object Model service. This may indicate an attempt to evade detection via suspicious process tree.

Asynchronous Procedure Call from Unusual Module

Identifies attempts to queue an Asynchronous Procedure Call (APC) to a remote process. This may indicate a remote code injection attack.

Potential Injection via NSIS Installer

Identifies allocation of RWX memory region from a Nullsoft scriptable installer. Adversaries may abuse NSIS installers to deliver malware for initial access.

Suspicious PHP Script Execution

Identifies the execution a PHP script utility that was recently dropped followed by an egress network activity or spawning a suspicious child process.

Unusual File Written or Modified in Startup Folder

Identifies suspicious file extensions or names written to the startup folder. Adversaries may use this technique to maintain persistence.

Privileged Domain Group Enumeration via LDAP

Identifies Active Directory privileged groups enumeration using LDAP search events. Adversaries attempt to enumerate groups with sensitive permissions to further escalate privileges.

Suspicious Oversized Script Execution

Identifies the execution of oversized Windows scripts. Adversaries may employ script padding with random data to evade sandbox detection restriction based on file size.