Browse Rules

Shellcode Execution via Python Script

Identifies attempt to allocate or execute shellcode from a Python script.

Remote Process Injection via Python

Identifies attempt to perform remote process code injection from a python program.

Evasion via Device Credential Deployment

Identifies attempts to hide Windows Command Console Window. Adversaries may use DeviceCredentialDeployment to evade user suspicion.

Suspicious Windows Core Module Change

Identifies attempts to change memory protection of a Windows Core Module often targeted for functions unhooking.

AMSI Bypass from Suspicious Module

Identifies attempts to modify the permissions or write to Microsoft Anti Malware Scan Interface DLL from unsigned module.

Suspicious Registry Hive Dump

Identifies attempts to dump registry hives containing access credential secrets, adversaries may dump registry to prepare for credential access.

Process Anti-Debug via Memory Patching

Identifies attempts to prevent a debugger from attaching to a process via patching the NTDLL module debugging functions.

Linux Reverse Shell via netcat

Detects the creation of a reverse shell through netcat. Attackers may spawn reverse shells to establish persistence onto a target system.

Registry Modification via WMI StdRegProv

Identifies registry modification using the Windows Management Instrumentation SrdRegProv provider. Adversaries may leverage WMI to modify system configuration via registry changes.

Curl Execution via Env Binary

Detects when curl is executed via the env binary. This is a common technique used by adversaries to avoid standard curl focused detections.

Execution via Program Compatibility Assistant

Identifies attempts to proxy execution using Microsoft Program Compatibility Assistant binary. Adversaries may use pcalua.exe to evade suspicious parent child process relationships.

Suspicious Execution from a PDF Documents

Identifies a suspicious execution from a PDF document with embedded objects. This behavior is consistent with the successful exploitation using spearphishing attachment.

Suspicious Kernel32 Memory Protection

Detects multiple Windows Memory API calls to modify the protection of the same memory address from Kernel32 module and in a short time window.

Chrome Browser Spawned from an Unusual Parent

Identifies instances where an unusual process spawns a chrome browser child process. This behavior could be related to malwares stealing browser information.

Suspicious Suspended Process Creation

Identifies suspicious attempts to create a process in suspended state by an unsigned or untrusted binary. This behavior is consistent with remote code injection attacks.

Execution via WMI followed by Network Connection

Identifies the execution of a process via Windows Management Instrumentation (WMI) and where the effective parent is performing network connections to the internet.

Node.js execution followed by network activity

Identifies attempts to execute JavaScript using the Node.js module followed by network connection. Adversaries may abuse this utility to execute malicious JavaScript.

Library Loaded From a Potentially Altered Call Stack

Detects attempts to load a networking module from a potentially altered call stack in order to conceal the true source of the call.

Potential Proxy Execution via PHP

This rule detects the execution of a command or binary through the PHP interpreter. Attackers may use this technique to execute commands while attempting to evade detection.

Potential CVE-2024-21338 Exploitation

Identifies unsigned code calling a vulnerable IOCTL in the appid.sys AppLocker driver. Adversaries may exploit this vulnerability to execute code in kernel mode and tamper with security solutions.

Unusual Command Execution via Cron

This rule detects the execution of suspicious commands and executables by cron. Threat actors may abuse cron to execute malicious commands or scripts to maintain persistence or escalate privileges.

AppleScript Decoded via Base64

Detects when AppleScript is executed followed by the execution of the Base64 binary with the decode option set. Several malware samples have been observed executing base64 encoded AppleScript in order to avoid detection.

Linux Reverse Shell

Detects the creation of a reverse shell through a suspicious parent child relationship spawned via a shell with suspicious command line arguments. Attackers may spawn reverse shells to establish persistence onto a target system.

Executable File Access or Modification via Osascript

Detects when a executable file is accessed or modified by Osascript on macOS. This activity should be considered malicious or highly suspicious and is indicative of initial access or tool ingress.

Hidden Process Execution followed by Network Connection

Detects when a hidden process is executed, and initiates an outbound network connection. Threat actors may drop hidden payloads that will later be used to download additional payload stages or tools.