Browse Rules

PowerShell Obfuscation Spawned via Microsoft Office

Identifies a Microsoft Office application (Word, PowerPoint, Excel) starting Windows PowerShell with a suspicious command line.

Unusual File Written or Modified in Startup Folder

Identifies suspicious file extensions or names written to the startup folder. Adversaries may use this technique to maintain persistence.

Suspicious Windows Script Interpreter Child Process

Identifies unusual windows script interpreter child process which could indicate code injection or other form of malicious code execution via Windows scripts.

Security Account Manager (SAM) Registry Access

Identifies attempts to read the Security Account Manager database through the registry, which adversaries can use to recover password hashes for local accounts.

Access to Browser Credentials from Suspicious Memory

Identifies access attempt to web browser's credential store data and from a memory region with suspicious properties. Adversaries may steal credentials from web browsers by reading files specific to the target browser.

Initial Access or Execution via Microsoft Office Application

Identifies when a Microsoft Office process spawns a descendant process used for initial access or malicious code execution. This behavior is consistent with a user opening an Office document that contains malicious macros.

RunDLL32/Regsvr32 Loads Dropped Executable

Identifies when RunDLL32 or Regsvr32 loads an executable that was dropped by commonly abused programs via phishing such as Microsoft Office or Powershell. An adversary may deliver a weaponized Office document to their target that writes and executes a malicious DLL.

Potential Privilege Escalation via Missing DLL

Identifies the loading of a non Microsoft signed DLL that is missing on a default Windows installation (phantom DLL) or one that can be loaded from a different location by a native Windows process. This may be abused to persist or elevate privileges via privileged file write vulnerabilities.