Browse Rules

Abnormal Auval Child Process Execution

Detects the execution of a process that should not be executed by the native auval or auvaltool binaries. This activity may occur after a threat actor loads a malicious audio unit plug-in via auval or auvaltool providing them unsigned code execution in the context of those binaries.

Abnormally Large Javascript Evaluation via Nodejs

Detects when an abnormally large amount of JavaScript is supplied to Node.js for execution via the evaluate flag. This behavior has been observed in DPRK-attributed malware campaigns.

Abnormally Large Shell Script Execution via Perl

Detects when Perl spawns a shell interpreter to execute an abnormally large script, indicated by a null command line despite having the expected argument count. This technique is commonly observed in npm typosquatting attacks where malicious packages use Perl as an intermediary to execute large embedded payloads that exceed normal command line size limits. Adversaries leverage Perl's trusted status to execute obfuscated or encoded shell scripts that perform credential harvesting, data exfiltrati

Access Attempt to Non Existing Cryptocurrency Wallet

Identifies access attempts to non existing cryptocurrency wallet files. Adversaries may perform discovery to steal potential cryptocurrency related files for for financial gains.

Access to Browser Credentials from Suspicious Memory

Identifies access attempt to web browser's credential store data and from a memory region with suspicious properties. Adversaries may steal credentials from web browsers by reading files specific to the target browser.

Access to Windows Passwords Vault by Unusual Process

Identifies access attempt to read the Windows Passwords Vault credentials by an unusual process. Adversaries may acquire credentials from Vault files.

Access to Windows Passwords Vault via Powershell

Identifies access attempt to the Windows Passwords Vault via Powershell commands. Adversaries may acquire credentials from Vault files.

Access Token Manipulation via Child Process

Adversaries may use access tokens to operate under a different user or system security context to elevate privileges and evade detection. For example, an attacker can create a new process that runs under the security context of another user in order to perform actions they would not normally have privileges for.

Active Directory Data Collection via LDAP

In an Active Directory LDAP query, (objectGUID=*) is a search filter that evaluates to TRUE for every object in the directory, meaning it will return all objects. This may indicate an attempt to dump AD database using tools such as ADExplorer for offline analysis or exfiltration.

AD Certificate Services Enumeration via LDAP

Identifies a list of LDAP queries used to enumerate Active Directory Certificate Services as a preparation step to identify potential AD Certificate Service attack paths.

AllowProtectedRenames Registry Modification

Identifies attempts to enable the modification of Trusted Installer protected resources via PendingFileRename operation. Malware may change this setting to hijack existing resources for execution and persistence.

AMSI Bypass from Suspicious Module

Identifies attempts to modify the permissions or write to Microsoft Anti Malware Scan Interface DLL from unsigned module.

AMSI Bypass via COM Registry Modification

Identifies attempts to disable the Microsoft Antimalware Scan Interface via registry modification. This may indicate an attempt to tamper with certain Windows native protections.

AMSI Bypass via PowerShell

Identifies the execution of PowerShell script with keywords related to different Antimalware Scan Interface (AMSI) bypasses. An adversary may attempt first to disable AMSI before executing further malicious powershell scripts to evade detection.

AMSI Bypass via Unbacked Memory

Identifies attempts to modify the permissions or write to Microsoft Anti Malware Scan Interface DLL from unbacked memory.

AMSI or WLDP Bypass via Memory Patching

Identifies attempts to modify the permissions or write to Microsoft Anti Malware Scan Interface or Windows Lock Down Policy related DLLs from memory. This may indicate an attempt to tamper with certain Windows native protections.

API Call from a Process with a Spoofed Parent

Detects Windows Memory API calls by a process with a fake parent process identity set to Windows Explorer often to blend in with user interactive activity.

API Call from a Suspicious Stack

Identifies the call to some Windows APIs from an unusual call stack. This may be the result of an evasion attempt to hide the origin of the API call from the call stack such as unbacked memory region.

API Call from Inaccessible Memory Page

Identifies API calls from memory regions unexpectedly marked as inaccessible. This may indicate an attempt to hide injected code from memory scanners.

API Call via Jump ROP Gadget

Identifies Windows Native API calls with ROP gadgets and from an unusual Microsoft signed module. This may be the result of a code injection.

API Call via Timer Callback Event

Identifies API calls via timeSetEvent callback function. This may indicate an attempt to proxy API call via callback.

API via Callback from a Suspicious Stack

Identifies the call of Memory Windows APIs indirectly via a callback function. This may be the result of an evasion attempt to hide the origin of the API call from the call stack such as unbacked memory region.

API via Trusted App Runtime DLL

Identifies attemtps to call Windows memory management APIs from the Trusted App Runtime DLL tprtdll.dll. This may indicate an attempt to execute syscalls from a trusted module while avoiding potential NTDLL hooks.

AppleScript Decoded via Base64

Detects when AppleScript is executed followed by the execution of the Base64 binary with the decode option set. Several malware samples have been observed executing base64 encoded AppleScript in order to avoid detection.

Application Javascript Injection via Nodejs

Detects when a JavaScript file within an application's directory structure gets modified via Node.js. Malicious npm packages have been observed hijacking legitimate applications like Cursor editor by injecting malicious JavaScript code into application files to enable persistent code execution.