Browse Rules

Arbitrary Python Code Execution via Nodejs

Detects the execution of arbitrary Python code via Nodejs.

Suspicious Execution via Windows Management Instrumentation

Identifies suspicious processes executing via the Windows Management Instrumentation (WMI) protocol.

Potential Injection via PyInstaller Executable

Identifies attempt to perform code injection using shellcode and from an unsigned PyInstaller executable.

Suspicious Okta Agent Cross Process Activity

Identifies attempt to perform code injection targeting OKTA related agent and service processes.

Suspicious WMI Event Consumer Subscription

WMI Event Consumers can be used by malware for file-less persistence, and are rare otherwise.

DLL Injection via MavInject Utility

Detects the utilization of the Microsoft MavInject utility to inject an arbitrary library into a remote process.

Execution of a Windows Script Downloaded from the Internet

Identifies the execution of a Windows script that was downloaded from the internet.

Suspicious PowerShell Execution

Identifies the execution of PowerShell with suspicious argument values. This behavior is often observed during malware installation leveraging PowerShell.

Suspicious Thread Context Manipulation

Identifies local thread context manipulation using SetThreadContext API. This may indicate an attempt to hijack process thread execution.

Group and Privileged Accounts Discovery via LDAP

Identifies a list of LDAP queries often used to perform Active Directory groups and privileges reconnaissance.

Potential Obfuscated PowerShell Script

Identifies the execution of PowerShell with potentially obfuscated content. This behavior is often observed during malware installation leveraging PowerShell.

Network Library Load via LdrLoadDLL

Identifies the load of a networking library by calling directly the LdrLoadDLL windows API and from an unsigned module.

PowerShell Script with Passwords Vault Access Capability

Identifies access attempt to the Windows Passwords Vault via Powershell. Adversaries may acquire credentials from Vault files.

VirtualProtect API Call from Unusual Stack

Identifies VirtualProtect API calls from unusual Kernelbase functions. This may be the result of a call stack spoofing.

Bind Shell via Node

Detects the creation of a bind shell via Node. Attackers may spawn bind shells to establish persistence onto a target system.

Msiexec Execution via a Windows Script Interpreter

Identifies when a Windows script attempts to execute commands using the Windows Installer service via Component Object Model.

JAVA Application Execution from Suspicious Paths

Identifies the execution of a Java JAR application from suspicious file paths such as downloads and compression utilities extraction paths.

Potential Execution via WinRAR Exploitation

Identifies suspicious child processes of the WinRAR process. This may indicate the successful exploitation of the WinRAR vulnerability CVE-2023-38831.

Suspicious Perl Child Process Execution

Detects when Perl executes suspicious child processes on macOS. Perl can be abused by adversaries to execute malicious commands or scripts.

Bind Shell via Netcat Traditional

Detects the creation of a bind shell via Netcat traditional. Attackers may spawn bind shells to establish persistence onto a target system.

Potential WinRAR CVE-2023-38831 Exploitation

Identifies suspicious child processes of the WinRAR process. This may indicate the successful exploitation of the WinRAR vulnerability CVE-2023-38831.

Executable File Modification via SSH

Detects executable file creation or modification via SSH sessions in temporary directories. This indicates potential malware deployment or tool staging by threat actors.

SSH Keys Accessed by Osascript

Identifies the Osascript process accessing SSH keys. Adversaries may steal SSHkeys in order to gain elevated privileges or move laterally to another system.

Suspicious Execution from INET Cache

Identifies the execution of a process with arguments pointing to the INetCache Folder. Adversaries may deliver malicious content via WININET during initial access.

Suspicious Windows Command Shell Execution

Identifies the execution of the Windows Command Shell process (cmd.exe) with suspicious argument values. This behavior is often observed during malware installation.