Browse Rules

Suspicious Execution via DCOM

Identifies suspicious execution via the Distributed Component Object Model service. This may indicate an attempt to evade detection via suspicious process tree.

Suspicious Windows Schedule Child Process

Identifies suspicious child processes of the Windows Schedule service. This behavior is consistent with an adversary executing malicious code or commands via an existing scheduled task.

Execution via Renamed Signed Binary Proxy

Identifies built-in Windows programs that have been renamed and can be used for execution, downloads, and/or evasion. Attackers may abuse this tactic to evade filename based detection of built-in tools.

Potential Binary Masquerading via Invalid Code Signature

Identifies binaries that have been identically named to Apple or popular third-party programs and have invalid or untrusted code signatures. Adversaries may attempt to manipulate the name of a process to make it appear legitimate or benign.

Potential Data Exfiltration via Curl

Detects the use of curl to upload an archived file to an internet server. Threat actors often will collect data on a system and compress it in an archive file before exfiltrating the file back to their C2 server for review. Many threat actors have been seen utilizing curl to upload this archive file with the collected data to do this. Use of curl in this way while not inherently malicious should be considered highly abnormal and suspicious activity.