Browse Rules

Suspicious Windows LDAP Image Load

Identifies the load of the Windows LDAP library and from a suspicious call stack trace.

WriteProcessMemory to Suspicious Memory Location

Identifies attempt to write a suspicious memory location. This behavior is consistent with remote code injection attacks.

AMSI Bypass via Unbacked Memory

Identifies attempts to modify the permissions or write to Microsoft Anti Malware Scan Interface DLL from unbacked memory.

Potential Shellcode Fluctuation v1

Identifies private (JIT) code memory with fluctuating page protections. This may indicate an attempt to hide injected code from memory scanners.

Windows Defender Exclusions via WMI

Identifies attempt to modify to the Windows Defender configuration settings to add an exclusion via the Windows Management Instrumentation method.

PowerShell Script with Screen Capture Capability

Detects PowerShell scripts that can take screenshots, which is a common feature in post-exploitation kits and remote access tools (RATs).

Suspicious Binary Execution via SSH

Detects SSH sessions executing suspicious binaries followed by outbound network connections. This pattern indicates potential post-exploitation activity via compromised SSH access.

Dylib Load via SSH-Keygen

Detects when the ssh-keygen binary is executed with the -D argument which can be used to load a malicious dylib into memory.

DLL Loaded from WebDav Share

Identifies the load of a library from a WebDav Share. Adversaries may abuse this method to evade dropping malicious files to victim file system.

PowerShell Engine Loaded via Injection

Identifies the PowerShell engine being invoked by unexpected processes. Instead of executing PowerShell functionality with powershell.exe, some attackers do this to operate more stealthily.

Potential AutoConfigURL Settings Hijack

Identifies registry modification to modify the system internet proxy settings by an unusual process. This may indicate an attempt to hijack user internet traffic to certain websites.

Shellcode Injection via PowerShell

Identifies shellcode execution behavior from a powershell script interpreter. This may indicate the execution of a malicious powershell script or the result of a cross process injection targeting powershell.

Suspicious Codesign Execution via Osacompile

Detects the abnormal execution of the codesign binary via Osacompile to forcefully sign all contents of a bundle. Threat actors may use this technique to bypass code signing requirements.

Suspicious Microsoft Office Embedded Object

Identifies suspicious file extensions written by a Microsoft Office process from an embedded OLE stream, this is frequently used by malicious documents to drop malicious content for initial access.

Untrusted DLL Loaded by a System Windows Process

Identifies attempts to load an unsigned and untrusted module by a SYSTEM process. This may indicate an attempt to elevate privileges via DLL search order hijacking.

OsaScript Download Cradle Spawned

Detects when a new OsaScript download cradle is spawned as a backgrounded process to launch a new callback. The Apfell agent payload utilizes this method in order to spawn additional payload callbacks.

Process Explorer Device Access by Unusual Process

Identifies unsigned code calling a 3rd party kernel driver function. Adversaries may bring a vulnerable or abusable driver onto a compromised machine to execute code with the highest privileges.

Execution of Javascript Payload via Osascript

Identifies when the native Osascript binary spawns itself to execute a Javascript payload. An adversary may use this technique to execute their malicious payload and obtain initial access to an endpoint.

Suspicious Command Execution via Windows Run

Identifies the execution of Windows commands via the Windows Run window. Adversaries may use phishing to instruct the victim to copy and paste malicious commands for execution via the Windows Run menu.

Suspicious Archive Creation via Ditto

Detects the use of the Ditto utility on macOS to create a compressed archive. The AMOS stealer has used this lesser known method for creating an archive containing the collected data for exfiltration via C2.

Netcat Reverse Shell via Busybox

This rule detects the creation of a reverse shell through netcat using Busybox. Attackers may spawn reverse shells to establish persistence onto a target system. By proxying the execution through Busybox, attackers may attempt to evade detection.

Linux Background Process Execution via Shell

Detects when a binary located in a suspicious location gets executed by a shell interpreter and put in the background via the & operator. Malware may execute their payloads in the background in an effort to remain hidden.

Potential Linux Hack Tool Launched

Monitors for the execution of different processes that might be used by attackers for malicious intent. An alert from this rule should be investigated further, as hack tools are commonly used by blue teamers and system administrators as well.

Potential Reverse Shell Activity via TCP/UDP Socket

This rule detects the execution of a shell process with suspicious arguments which may be indicative of reverse shell activity. Attackers may use the "/dev/tcp" or "/dev/udp" file descriptors to establish a reverse shell connection.

Keystrokes Input Capture from a Suspicious Module

Identifies attempts to enumerate the state of keyboard keys and the call is coming from Python, AutoIt, NodeJs or LUA libraries. Adversaries may log user keystrokes to intercept credentials or other information from the user as the user types them.