Browse Rules

Initial Access Discovery via Applet Executable

Detects the execution of a system or user discovery command via a compiled Apple script binary Applet.

Potential Python Stealer

Detects the execution of a Python script followed by at least 3 consecutive access attempts on sensitive files within a 30 second window.

Potential Injection via Asynchronous Procedure Call

Identifies attempts to queue an Asynchronous Procedure Call (APC) to a remote process. This may indicate a remote code injection attack.

Suspicious File Rename from Unbacked Memory

Identifies a suspicious file rename operation from an unbacked memory region. This may indicate Ransomware behavior from an injected trusted process.

Interactive Shell Spawned via Hidden Process

Detects when a hidden process spawns an interactive shell. This behavior may indicate a malicious actor attempting to execute post-exploitation commands.

Shadow Copy Deletion via Windows Management Instrumentation

Identifies suspicious processes using Windows Management Instrumentation (WMI) to delete shadow copies. Adversaries may delete shadow copies to prevent system recovery.

Access to Windows Passwords Vault by Unusual Process

Identifies access attempt to read the Windows Passwords Vault credentials by an unusual process. Adversaries may acquire credentials from Vault files.

Binary Proxy Execution via Windows OpenSSH

Identifies attempts to execute programs via the Windows OpenSSH client. This may indicate an attempt to bypass application control via trusted windows binaries.

Suspicious Memory Size Protection via VirtualProtect

Identifies when a process attempts to change memory region using VirtualProtect API from non executable to executable permissions and the size is abnormal.

Access Attempt to Non Existing Cryptocurrency Wallet

Identifies access attempts to non existing cryptocurrency wallet files. Adversaries may perform discovery to steal potential cryptocurrency related files for for financial gains.

Potential Evasion via ASP.NET Compiler

Identifies the execution of the ASPNET Compiler utility to execute cshap code passed via arguments. Adversaries may abuse this utility to run malicious code.

JAVA Application with Unusual File Extension

Identifies the execution of a Java JAR application with an unusual file extension. Malicious files may masquerade as non executable file extensions to evade defenses.

Oversized Windows Script Execution

Identifies the execution of a Windows script with file size more than 30MB. Adversaries may use large files to bypass online malware sandbox file upload size limitation.

Potential Remote Code Execution via Mail Server

This rule detects potential remote code execution attempts via commonly used mail server applications, by monitoring for unusual child processes and command line arguments.

Linux Reverse Shell via Child

Detects the creation of a reverse shell through a shell with suspicious command line arguments. Attackers may spawn reverse shells to establish persistence onto a target system.

User Discovery Command Execution from Volume Mount

Detects the execution of a user discovery command from a mounted volume. This is highly abnormal behavior and can be an indication of malicious activity.

Base64 Encoded String Execution via Osascript

Detects when Osascript executes AppleScript containing a base64 encoded string. Many stealer samples execute AppleScript and some encode the script using base64 in order to avoid detection.

Python Library Load and Delete

Detects Python loading a library from a user's home directory followed by immediate deletion. This technique is used by malware to execute code while removing forensic evidence.

Shellcode from Unusual Microsoft Signed Module

Identifies attempts to allocate or execute shellcode from unbacked memory and where the protection provenance of the unbacked region is coming from an unusual signed Microsoft module.

System Binary Proxy Execution via ld.so

This rule detects the execution of a binary through the ld.so dynamic linker. Attackers may use this technique to execute binaries while attempting to evade detection.

Persistence via GenAI Tool

Detects when a GenAI process or descendant attempts to modify commonly abused file persistence entries. This activity could be the result of exploiting a prompt injection vulnerability or compromised external dependency.

Shellcode Injection with Parent as Provenance

Identifies when a process attempts to allocate or execute shellcode from an unbacked memory and where the protection provenance of that memory region is coming from the parent process.

Binary Proxy Execution via Runexehelper

Identifies the execution of a binary via the Windows RunExeHelper utility. Adversaries may bypass process and signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.

Network Activity from a Reflected Process

Identifies the creation of process clone via the Windows API RtlCreateProcessReflection followed by network activity. This may indicate an attempt to create a process as a target for process injection.

Hidden Executable Initiated Egress Network Connection

This rule detects when a hidden process executes a command that includes an IP address as an argument and initiates an egress network connection. This may indicate command and control behavior.