Browse Rules

Suspicious WMI Library Load

Identifies the load of Windows Management Instrumentation related libraries and from suspicious call stack.

Potential AMSI Bypass via SetThreadContext

Identifies attempts to bypass the Microsoft Anti Malware Scan Interface via threat context manipulation.

Potential Pentesting PowerShell Script

Identifies the execution of PowerShell scripts with keywords from known open source penetration testing tools.

Delayed Common Language Runtime Load

Identifies a delayed load of the Microsoft Common Language Runtime DLL CLR.dll associated with egress network connections.

Lateral Execution via DCOM Office Application

Identifies remote execution via Distributed Component Object Model service to launch a process via a Microsoft Office application.

Suspicious Windows Script Base64 Encoding

Detects the execution of a Windows script with base64 encoding along with other suspicious features like execution and download.

VirtualProtect via Indirect Syscall

Identifies VirtualProtect API calls using indirect syscall. This may be an attempt to conceal the true source of the call.

Command and Scripting Interpreter from Suspicious Parent

Identifies when a script interpreter is executed with a long command line and from an unsigned parent executable.

Linux Hidden File Mounted

Detects when a hidden file gets mounted. This is suspicious behavior, and has been observed in MacOS and Linux malware samples.

Potential Unbacked Memory Content Masking

Detects multiple Windows Memory API calls to modify the protection of the same memory address in a short time window.

User Account Control Disabled via Registry

Identifies attempts to disable Users Account Control via registry modification. Malware may disable UAC to run with high integrity.

Library Loaded from a Spoofed Call Stack

Detects library load from a potentially altered call stack in order to conceal the true source of the call.

Suspicious File Rename via SMB

Identifies an incoming SMB connection followed by a suspicious file rename operation. This may indicate a remote ransomware attack via the SMB protocol.

Unusual Execution from /dev Parent

This rule detects suspicious executions from /dev parent directories. Attackers may execute binaries from /dev parent directories to evade detection and execute malicious payloads.

AllowProtectedRenames Registry Modification

Identifies attempts to enable the modification of Trusted Installer protected resources via PendingFileRename operation. Malware may change this setting to hijack existing resources for execution and persistence.

NotificationCenter Silenced via Killall Binary

Detects when the killall process is spawned in order to kill NotificationCenter messages that provide users with pop up system notifications like security warnings etc.

Crypto Wallet or Web Browser File Access via Python

Detects when Python accesses crypto wallet or web browser files on a macOS system like crypto wallet files, or web browser cookies.

Long Base64 Command Execution via Interactive Shell

Identifies attempts to execute commands with long base64 encoded command lines via an interactive shell. Adversaries may abuse this technique to execute malicious commands.

Network File Unzipped via Unsigned or Untrusted Binary

Detects the decompression of a file into a specified folder directly from a network download using unzip via an unsigned or untrusted binary.

Web Browser Credential Data Accessed by Osascript

Detects when Osascript is seen accessing sensitive web browser files. Adversaries may steal credentials from web browsers by reading files specific to the target browser.

NTDLL library loaded for a second time

Identifies the load of NTDLL for the second time. This may indicate the use of direct system calls to evade endpoint security solutions hooking Windows APIs.

Reverse or Bind Shell via Suspicious Utility

Detects the creation of a reverse or bind shell through suspicious utilities. Attackers may spawn reverse or bind shells to establish persistence onto a target system.

Potential HackersChoice Tool Downloaded

Identifies processes that are capable of downloading files with command line arguments containing URLs to HackersChoice's tools. These tools are often used by threat actors to gain access to systems.

Suspicious Browser Preferences File Modification

Identifies the modification of commonly used browsers settings via Preferences change. Adversaries may install a rogue browser extension or disable certain browser hardening settings to maintain persistence or evade restrictions.

Binary Proxy Execution via AppVLP

Identifies the execution of a binary via the Application Virtualization Utility. Adversaries may bypass process and signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.