Browse Rules

Suspicious PowerShell Execution via Windows Scripts

Identifies suspicious PowerShell execution spawning from Windows Script Host processes (cscript or wscript.exe).

Suspicious Script or Process Execution from Mounted Device

Detects potential execution of a script or unsigned macOS binary from a mounted device. Malware may abuse DMG files to deliver malicious code or scripts to gain initial access.

Suspicious Parent-Child Relationship

Identifies Windows programs run with unexpected parent processes, which can indicate masquerading via process hollowing or other forms of code injection in an attempt to evade detections that monitor the execution from suspicious locations.