Detectors

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics BIOC	A browser extension was installed or loaded in an uncommon way A browser extension was installed or loaded in an uncommon way.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	A contained executable was executed by an unusual process A Docker-contained executable from a mounted share was executed on a host. Running a contained executable is highly dangerous and atypical.	Medium	Platform Analytics	XDR Agent	Privilege Escalation, Persistence
Analytics BIOC	A process modified an SSH authorized_keys file A process modified an SSH authorized_keys file, which is used in SSH authentication. An attack can add or remove an SSH key to gain access to a targeted host.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process A signed DLL was loaded into a Microsoft-signed process. This DLL hash and signature vendor are rare, which might indicate an attacker performing DLL hijacking.	Informational	Platform Analytics	XDR Agent	Persistence, Privilege Escalation, Defense Evasion
Analytics BIOC	A rare file path was added to the AppInit_DLLs registry value A rare file path was added to AppInit_DLLs registry value.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Privilege Escalation
Analytics BIOC	A WMI subscriber was created A WMI subscriber was created.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Privilege Escalation
BIOC	Account creation via command-line tool The useradd/adduser command could be used to create user accounts or to add users to existing groups.	Informational	Platform Analytics	Process execution	Persistence
BIOC	Active Setup Registry Autostart Suspicious modification of the active setup registry for persistence and privilege escalation.	Low	Platform Analytics	Registry	Persistence
Analytics	An executable was written and executed by a web server Web server process had written an executable file that was executed shortly after.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	An uncommon file added to startup-related Registry keys An attacker may add a file to the Registry "Run Keys" or the "Winlogon\Userinit" key to cause it to be executed as the user logs in.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	An uncommon file was created in the startup folder An uncommon file was created in the startup folder.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	An uncommon lolbin execution by scheduled task A lolbin was executed with uncommon commandline by a scheduled task.	Informational	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	An uncommon service was started An uncommon service was started using systemctl or service processes.	Low	Platform Analytics	XDR Agent	Persistence, Privilege Escalation
Analytics	An unsigned process created scheduled task and performed an injection An unsigned process created scheduled task and performed an injection.	Medium	Platform Analytics	XDR Agent	Persistence, Defense Evasion
Analytics BIOC	Autorun.inf created in root C drive An autorun file installed at the root of a C:\ drive is suspicious, as autorun files are typically associated with removable drives.	Medium	Platform Analytics	XDR Agent	Persistence, Lateral Movement
Analytics BIOC	Bitsadmin.exe persistence using command-line callback BITSAdmin.exe was used with a command-line that may indicate malware trying to gain persistence on the machine.	Medium	Platform Analytics	XDR Agent	Persistence
BIOC	Bitsadmin.exe used to download data Some attacks were known for abusing BITSAdmin in the past to hide how data was downloaded using legitimate Windows tools.	Informational	Platform Analytics	Process execution	Persistence
Analytics BIOC	Browser Extension Installed Uncommon browser extension installed.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Correlation Rule	Chrome - Chrome Extension Install Event The extension $xdm.target.resource.name was installed on $xdm.source.host.hostname by $xdm.intermediate.user.username	Low	Platform Analytics	google_workspace_chrome_raw	Persistence
BIOC	Chrome runs with key security features disabled This chrome process ran with command line arguments that disabled key security features disabled. It can have legitimate uses, but this technique is often used by malware to load malicious or untrusted browser extensions.	Low	Platform Analytics	Process execution	Persistence
BIOC	Commonly abused host process modifies the Windows shim cache Has legitimate usage for Microsoft patches, but check for malicious execution for persistence. Known FIN7/Carbanak technique.	Informational	Platform Analytics	Process execution	Persistence
BIOC	Creation of a new Microsoft Office default template Microsoft Office contains default templates that open whenever you start Word or Excel. Attackers may create them to establish persistence.	Informational	Platform Analytics	File	Persistence
Analytics BIOC	Executable or Script file written by a web server process An uncommon executable or script file was created, written, or renamed by a web server process.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Initial Access, Persistence
Analytics BIOC	Execution of an uncommon process at an early startup stage Uncommon execution of an executable found in an early startup stage.	Informational	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Execution of an uncommon process at an early startup stage by Windows system binary Uncommon execution of an executable found in an early startup stage by Windows system binary.	Low	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Execution of an uncommon process with a local/domain user SID at an early startup stage Execution of an uncommon process with a local/domain user SID at an early startup stage may be an indication of a persistent mechanism on boot that is being actively abused.	Informational	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Globally uncommon injection from a signed process A signed process injected into another process that it does not normally target at a global level.	Informational	Platform Analytics	XDR Agent	Defense Evasion, Persistence
Analytics BIOC	Image file execution options (IFEO) registry key set Attackers may use the Image File Execution Options Registry key to launch their executable whenever the user attempts to execute a certain executable.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Privilege Escalation, Persistence
Analytics BIOC	Installation of a new System-V service Installation of a new System-V service.	Low	Platform Analytics	XDR Agent	Persistence, Privilege Escalation
BIOC	Kernel modules loaded via command-line tool The insmod/depmod command loads a kernel module; attackers may use kernel modules as rootkits.	Informational	Platform Analytics	Process execution	Persistence
BIOC	Kernel modules loaded via compiled loader and .ko file Instead of using insmod/depmod, an attacker can build a loader and load a kernel module; attackers may use kernel modules as rootkits.	Informational	Platform Analytics	Process execution	Persistence
Analytics BIOC	Known service display name with uncommon image-path Service created with a known display name but has an uncommon image-path.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Execution
Analytics BIOC	Known service name with an uncommon image-path A Service with a known service name has an uncommon image-path.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Execution
BIOC	Manipulation of 'BootExecute' Registry run key Smss.exe will launch anything present in the BootExecute Registry key under HKLM\SYSTEM\ControlSet002\Control\Session Manager. The BootExecute key should only contain "autocheck autochk*". If there are additional values in it, they are probably used for malware persistence.	Informational	Platform Analytics	Registry	Persistence
BIOC	Manipulation of AppInit DLL loading list The AppInit DLLs Registry key contains a list of DLLs that will be loaded when user32.dll is loaded. As most Windows executables use the user32.dll, any DLL that is listed in the AppInit_DLLs Registry key will be loaded also. The user32.dll file is also used by processes that are automatically started by the system when you log on.	Informational	Platform Analytics	Registry	Persistence
BIOC	Manipulation of Application Verifier custom providers The Application Verifier assists developers in quickly finding subtle programming errors that can be extremely difficult to identify with normal application testing. Using Application Verifier in Visual Studio makes it easier to create reliable applications by identifying errors caused by heap corruption, incorrect handle and critical section usage. Changing the providers could change handling. An attacker can use this ability to inject a custom verifier into any application. Once the custom verifier has been injected, the attacker now has full control over the application.	Informational	Platform Analytics	Registry	Persistence
BIOC	Manipulation of autostart related system files May be used as a malware persistence technique, as these files have relevancy to the startup routine of Windows.	Informational	Platform Analytics	File	Persistence
BIOC	Manipulation of default file association configuration When a file is opened, the default program used to open the file, its handler, is checked. File association selections are stored in the Windows Registry and can be edited by users. Malware can modify or create a file association for a given file extension to call another program when a given extension is opened.	Informational	Platform Analytics	Registry	Persistence
BIOC	Manipulation of default file extension configuration Alerts when a handler of a known file extension is modified. Applicable to EXE, DLL, SYS, PS1, BAT, CMD, ZIP and LNK extensions.	Low	Platform Analytics	Registry	Persistence
BIOC	Manipulation of Firefox plugins and extensions via the Registry Plugins and extensions are loaded from all of these Registry keys.	Medium	Platform Analytics	Registry	Persistence
Analytics BIOC	Manipulation of netsh helper DLLs Registry keys Registering netsh helper DLLs is uncommon, and could be used by malware for persistence.	Medium	Platform Analytics	XDR Agent	Persistence
BIOC	Manipulation of service imagepath configuration This key specifies the location of the executable file for the driver or service. Malicious executables might be installed in these paths.	Informational	Platform Analytics	Registry	Persistence
BIOC	Manipulation of the MonitorProcess Registry key Entries added under the Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit can be used to run malicious code and help attackers gain persistence.	Medium	Platform Analytics	Registry	Persistence
BIOC	Manipulation of Winlogon 'Notify' autostart Registry key Since Winlogon handles the Secure Attention Sequence (SAS) (Ctrl+Alt+Del), notify subkeys found at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify are used to notify event handles when SAS happens and load a DLL. This DLL can be edited to launch whenever such a SAS event occurs.	Informational	Platform Analytics	Registry	Persistence
BIOC	Manipulation of Winlogon 'UserInit' autostart Registry key Winlogon process uses the value specified in the UserInit key to launch login scripts etc. This key is location at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon. Usually, UserInit key points to userinit.exe but if this key can be altered, then that EXE will also launch by Winlogon.	Medium	Platform Analytics	Registry	Persistence
Analytics BIOC	Microsoft Office adds a value to autostart Registry key Microsoft Office adds a value to a registry entry (run keys, startup folders) to establish persistence.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
BIOC	Modification of default Windows startup path via Registry An attacker may modify the startup path to the location of the malware.	Informational	Platform Analytics	Registry	Persistence
BIOC	Modification of logon scripts via Registry Windows logon scripts are stored in ``HKCU\Environment\UserInitMprLogonScript`` and trigger when a user logs in. Attackers may abuse them for persistence.	Medium	Platform Analytics	Registry	Persistence
Analytics BIOC	Modification of PAM Modification of PAM configuration files.	Informational	Platform Analytics	XDR Agent	Persistence, Defense Evasion, Credential Access
BIOC	Modification of systemd service files An attacker may create or modify systemd service unit files to establish persistence between reboots.	Informational	Platform Analytics	File	Persistence
BIOC	Modification of the Winlogon\Shell Registry key Malware may modify the Winlogon\Shell Registry value to load itself instead of explorer.exe, which is the default system shell.	Informational	Platform Analytics	Registry	Persistence
BIOC	Multiple RDP sessions enabled via Registry Attackers may allow multiple RDP sessions, so they could access the machine at the same time the user does.	Medium	Platform Analytics	Registry	Persistence, Lateral Movement
BIOC	New entry added to startup related Registry keys by unsigned process Entries added to the "Run Keys" in the Registry or the startup folder will cause the program to be executed when the user logs in. The program will be executed in the context of the user and will have his permissions level.	Informational	Platform Analytics	Registry	Persistence
BIOC	New local user created via PowerShell command line Attackers may create new local users to persist access to machines.	Medium	Platform Analytics	Process execution	Persistence
BIOC	New service created via command line Attackers may leverage services to gain persistence on an endpoint.	Informational	Platform Analytics	Process execution	Persistence
Analytics BIOC	Office process accessed an unusual .LNK file An attacker may embed a .LNK file in an Office document to execute malicious code.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Execution, Persistence
BIOC	Persistence through service registration An attacker may add or modify system services to persist on a host.	Informational	Platform Analytics	File	Persistence
BIOC	Persistence using bashrc files Possible persistency using shell (bash\csh) profile files. Commands in ~/.bashrc are executed on every new shell execution.	Informational	Platform Analytics	File	Persistence
BIOC	Persistence using cron jobs Cron jobs are tasks to be executed sometime in the future, and could be used to persist malware.	Informational	Platform Analytics	File	Persistence
BIOC	Persistence via Registry screensaver key change Attackers may install their malware persistently by modifying the value of the screensaver Registry key.	Informational	Platform Analytics	Registry	Persistence
Analytics BIOC	Phantom DLL Loading An attacker might leverage existing processes missing module loads to load malicious code into trusted processes.	Medium	Platform Analytics	XDR Agent	Persistence
BIOC	Port Monitor added in Registry Adversaries may use port monitors to run an adversary-supplied DLL during system boot for persistence or privilege escalation.	Low	Platform Analytics	Registry	Persistence
Analytics BIOC	Possible DLL Hijack into a Microsoft process An unsigned DLL was loaded into a Microsoft signed process. This DLL name is usually signed by Microsoft, which might indicate an attacker performing DLL Hijacking.	Informational	Platform Analytics	XDR Agent	Persistence, Privilege Escalation, Defense Evasion
Analytics BIOC	Possible DLL Search Order Hijacking An attacker might abuse the Windows DLL search order to trigger known, signed processes to load the attacker's malicious module.	Low	Platform Analytics	XDR Agent	Persistence, Privilege Escalation, Defense Evasion
Analytics BIOC	Possible Persistence via group policy Registry keys Group Policy registry keys were read during system startup. This behavior may indicate a persistence mechanism that triggers on reboot to execute malicious code.	Medium	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
BIOC	Possible web shell command execution Possible command execution via a web shell for reconnaissance.	Informational	Platform Analytics	Process execution	Persistence
Analytics BIOC	Possible webshell file written by a web server process An uncommon file with a web file extension was created, written or renamed by a web server process.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Initial Access, Persistence
BIOC	Possible XDG autostart persistency Possible persistency gained by writing or creating a desktop file inside the xdg autostart directory.	Informational	Platform Analytics	File	Persistence
BIOC	Potential web shell installation A web-app script file was installed on a web server. This can indicate an installation of web shell.	Informational	Platform Analytics	File	Persistence
BIOC	PowerShell creates a new service PowerShell creates a new service via a command line. This can be used by attackers to be persistent on a machine.	Low	Platform Analytics	Process execution	Persistence
BIOC	PowerShell downloads files via BITS This PowerShell argument is often used to run commands with malicious intent.	Medium	Platform Analytics	Process execution	Persistence
BIOC	Print Processor Registration Adversaries may abuse print processors to run malicious DLLs during system boot that will be executed as SYSTEM for privilege escalation and/or persistence.	Low	Platform Analytics	Registry	Persistence
BIOC	Print spooler set to load new DLL on boot Malware can use this technique to load malicious code at startup that will persist on system reboot. This DLL must be located in C:\Windows\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot. A port monitor can be set through the AddMonitor API.	Informational	Platform Analytics	Registry	Persistence
Analytics	Rare access to known advertising domains The endpoint performed many connections to unpopular advertising domains. This could indicate the presence of adware on the endpoint.	Informational	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Command and Control, Persistence
Analytics BIOC	Rare scheduled task created A new rare scheduled task was created with a rare path and a rare command line.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	Rare Scheduled Task RPC activity The endpoint performed abnormal Scheduled Task RPC activity to a remote host.	Informational	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)	Lateral Movement, Persistence
Analytics BIOC	Rare Scheduled Task RPC activity from a rarely seen host The endpoint performed abnormal Scheduled Task RPC activity to a remote host.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)	Lateral Movement, Persistence
Analytics BIOC	Rare service DLL was added to the registry A service was added as a dll, which will be executed by svchost.exe. This is a stealthy technique attackers use to persist their malware.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion, Persistence
Analytics BIOC	Rare unsigned process execution by scheduled task Rare and unsigned process was executed by a scheduled task.	Low	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Scrcons.exe Rare Child Process The Windows Management Instrumentation (WMI) standard event consumer scrcons.exe executed a rare VBScript or PowerShell script. Executing a rare script can be an indication of local or remote code execution abuse by an attacker.	Informational	Platform Analytics	XDR Agent	Execution, Persistence
Analytics BIOC	Screensaver process executed from Users or temporary folder An executable file with a screensaver extension was executed from the Users or temp folder. This is not a common behavior for screensavers and may indicate a malicious file disguised as a screensaver in the Users or temp folder. It is recommended to further investigate the execution flow for malicious indicators.	Low	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Script file added to startup-related Registry keys An attacker may add a script file to the Registry "Run Keys" or the "Winlogon\Userinit" key to cause it to be executed as the user logs in.	Medium	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	SecureBoot was disabled SecureBoot was disabled, this might be indicative of someone trying to install an alternate non-UEFI supported OS.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	Setting Windows Auto Logon by uncommon process Setting Windows Auto Logon by uncommon process.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
BIOC	Shim database file access An attacker may install a malicious SDB (shim database) file on disk for privilege escalation and persistence.	Informational	Platform Analytics	File	Persistence, Privilege Escalation
BIOC	Shim database registration via Registry Application shim databases may be leveraged for privilege escalation and persistence, and can be installed by modifying the Registry.	Informational	Platform Analytics	Registry	Persistence
Analytics BIOC	Signed process creates a scheduled task via file access A signed process created a scheduled task via file access. Attackers may create scheduled tasks for execution and to establish persistence.	Informational	Platform Analytics	XDR Agent	Execution, Persistence
Analytics BIOC	Suspicious active setup registered The endpoint registered a new active setup, which may be used to gain persistence on the host by loading libraries into the time management service.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	Suspicious authentication package registered The endpoint registered a suspicious authentication package, which may be used to gain persistence on the host by loading libraries into the time management service.	Medium	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Suspicious container orchestration job A suspicious orchestration job ran with a rare command line.	Low	Platform Analytics	XDR Agent	Execution, Persistence, Privilege Escalation
Analytics BIOC	Suspicious HTTP parameters detected The endpoint received suspicious HTTP parameters via an HTTP request, which may indicate attempts to exploit server components or web shell activity.	Medium	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Initial Access, Persistence
Analytics BIOC	Suspicious print processor registered The endpoint registered a new print processor, which may be used to gain persistence on the host by loading libraries into the time management service.	Medium	Platform Analytics	XDR Agent	Persistence
BIOC	Suspicious printer driver installation A suspicious process installed a generic printer driver. This may be a sign of CVE-2020-1048, in which an attacker attempts to overwrite a file on the OS.	Low	Platform Analytics	Registry	Privilege Escalation, Persistence
BIOC	Suspicious printer port creation via Registry An attacker may create a print job that prints to a file, overwriting any file on the OS (CVE-2020-1048).	Medium	Platform Analytics	Registry	Privilege Escalation, Persistence
Analytics BIOC	Suspicious process modified RC script file A suspicious process modified an RC script file. These files allow system administrators to map and start custom services at startup for different run levels. This may be done to establish persistence.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Privilege Escalation
Analytics BIOC	Suspicious RunOnce Parent Process Runonce.exe executes commands under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, typically on computer boot and user login events.	Low	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Suspicious runonce.exe parent process Runonce.exe executes commands under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, typically on computer boot and user logon events.	Low	Platform Analytics	XDR Agent	Persistence
BIOC	Suspicious SDB file written to disk Application Shims were created to allow backward compatibility of applications, which can be abused to establish persistence or elevate privileges. The creation of SDB (Shim Database) files may be indicative of this technique.	Informational	Platform Analytics	File	Persistence
BIOC	Suspicious SDB file written to disk by an unsigned process Application Shims were created to allow backward compatibility of applications, which can be abused to establish persistence or elevate privileges. The creation of SDB (Shim Database) files by an unsigned process may be indicative of this technique.	Informational	Platform Analytics	File	Persistence
Analytics BIOC	Suspicious systemd timer activity Suspicious systemd timer activity, which may indicate an attempt to establish persistence.	Low	Platform Analytics	XDR Agent	Execution, Persistence, Privilege Escalation

Analytics BIOC

A browser extension was installed or loaded in an uncommon way A browser extension was installed or loaded in an uncommon way.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

A contained executable was executed by an unusual process A Docker-contained executable from a mounted share was executed on a host. Running a contained executable is highly dangerous and atypical.

Medium

Platform Analytics

XDR Agent

Privilege Escalation, Persistence

Analytics BIOC

A process modified an SSH authorized_keys file A process modified an SSH authorized_keys file, which is used in SSH authentication. An attack can add or remove an SSH key to gain access to a targeted host.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process A signed DLL was loaded into a Microsoft-signed process. This DLL hash and signature vendor are rare, which might indicate an attacker performing DLL hijacking.

Informational

Platform Analytics

XDR Agent

Persistence, Privilege Escalation, Defense Evasion

Analytics BIOC

A rare file path was added to the AppInit_DLLs registry value A rare file path was added to AppInit_DLLs registry value.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Privilege Escalation

Analytics BIOC

A WMI subscriber was created A WMI subscriber was created.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Privilege Escalation

BIOC

Account creation via command-line tool The useradd/adduser command could be used to create user accounts or to add users to existing groups.

Informational

Platform Analytics

Process execution

Persistence

BIOC

Active Setup Registry Autostart Suspicious modification of the active setup registry for persistence and privilege escalation.

Low

Platform Analytics

Registry

Persistence

Analytics

An executable was written and executed by a web server Web server process had written an executable file that was executed shortly after.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

An uncommon file added to startup-related Registry keys An attacker may add a file to the Registry "Run Keys" or the "Winlogon\Userinit" key to cause it to be executed as the user logs in.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

An uncommon file was created in the startup folder An uncommon file was created in the startup folder.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

An uncommon lolbin execution by scheduled task A lolbin was executed with uncommon commandline by a scheduled task.

Informational

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

An uncommon service was started An uncommon service was started using systemctl or service processes.

Low

Platform Analytics

XDR Agent

Persistence, Privilege Escalation

Analytics

An unsigned process created scheduled task and performed an injection An unsigned process created scheduled task and performed an injection.

Medium

Platform Analytics

XDR Agent

Persistence, Defense Evasion

Analytics BIOC

Autorun.inf created in root C drive An autorun file installed at the root of a C:\ drive is suspicious, as autorun files are typically associated with removable drives.

Medium

Platform Analytics

XDR Agent

Persistence, Lateral Movement

Analytics BIOC

Bitsadmin.exe persistence using command-line callback BITSAdmin.exe was used with a command-line that may indicate malware trying to gain persistence on the machine.

Medium

Platform Analytics

XDR Agent

Persistence

BIOC

Bitsadmin.exe used to download data Some attacks were known for abusing BITSAdmin in the past to hide how data was downloaded using legitimate Windows tools.

Informational

Platform Analytics

Process execution

Persistence

Analytics BIOC

Browser Extension Installed Uncommon browser extension installed.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Correlation Rule

Chrome - Chrome Extension Install Event The extension $xdm.target.resource.name was installed on $xdm.source.host.hostname by $xdm.intermediate.user.username

Low

Platform Analytics

google_workspace_chrome_raw

Persistence

BIOC

Chrome runs with key security features disabled This chrome process ran with command line arguments that disabled key security features disabled. It can have legitimate uses, but this technique is often used by malware to load malicious or untrusted browser extensions.

Low

Platform Analytics

Process execution

Persistence

BIOC

Commonly abused host process modifies the Windows shim cache Has legitimate usage for Microsoft patches, but check for malicious execution for persistence. Known FIN7/Carbanak technique.

Informational

Platform Analytics

Process execution

Persistence

BIOC

Creation of a new Microsoft Office default template Microsoft Office contains default templates that open whenever you start Word or Excel. Attackers may create them to establish persistence.

Informational

Platform Analytics

File

Persistence

Analytics BIOC

Executable or Script file written by a web server process An uncommon executable or script file was created, written, or renamed by a web server process.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Initial Access, Persistence

Analytics BIOC

Execution of an uncommon process at an early startup stage Uncommon execution of an executable found in an early startup stage.

Informational

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Execution of an uncommon process at an early startup stage by Windows system binary Uncommon execution of an executable found in an early startup stage by Windows system binary.

Low

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Execution of an uncommon process with a local/domain user SID at an early startup stage Execution of an uncommon process with a local/domain user SID at an early startup stage may be an indication of a persistent mechanism on boot that is being actively abused.

Informational

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Globally uncommon injection from a signed process A signed process injected into another process that it does not normally target at a global level.

Informational

Platform Analytics

XDR Agent

Defense Evasion, Persistence

Analytics BIOC

Image file execution options (IFEO) registry key set Attackers may use the Image File Execution Options Registry key to launch their executable whenever the user attempts to execute a certain executable.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Privilege Escalation, Persistence

Analytics BIOC

Installation of a new System-V service Installation of a new System-V service.

Low

Platform Analytics

XDR Agent

Persistence, Privilege Escalation

BIOC

Kernel modules loaded via command-line tool The insmod/depmod command loads a kernel module; attackers may use kernel modules as rootkits.

Informational

Platform Analytics

Process execution

Persistence

BIOC

Kernel modules loaded via compiled loader and .ko file Instead of using insmod/depmod, an attacker can build a loader and load a kernel module; attackers may use kernel modules as rootkits.

Informational

Platform Analytics

Process execution

Persistence

Analytics BIOC

Known service display name with uncommon image-path Service created with a known display name but has an uncommon image-path.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Execution

Analytics BIOC

Known service name with an uncommon image-path A Service with a known service name has an uncommon image-path.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Execution

BIOC

Manipulation of 'BootExecute' Registry run key Smss.exe will launch anything present in the BootExecute Registry key under HKLM\SYSTEM\ControlSet002\Control\Session Manager. The BootExecute key should only contain "autocheck autochk*". If there are additional values in it, they are probably used for malware persistence.

Informational

Platform Analytics

Registry

Persistence

BIOC

Manipulation of AppInit DLL loading list The AppInit DLLs Registry key contains a list of DLLs that will be loaded when user32.dll is loaded. As most Windows executables use the user32.dll, any DLL that is listed in the AppInit_DLLs Registry key will be loaded also. The user32.dll file is also used by processes that are automatically started by the system when you log on.

Informational

Platform Analytics

Registry

Persistence

BIOC

Manipulation of Application Verifier custom providers The Application Verifier assists developers in quickly finding subtle programming errors that can be extremely difficult to identify with normal application testing. Using Application Verifier in Visual Studio makes it easier to create reliable applications by identifying errors caused by heap corruption, incorrect handle and critical section usage. Changing the providers could change handling. An attacker can use this ability to inject a custom verifier into any application. Once the custom verifier has been injected, the attacker now has full control over the application.

Informational

Platform Analytics

Registry

Persistence

BIOC

Manipulation of autostart related system files May be used as a malware persistence technique, as these files have relevancy to the startup routine of Windows.

Informational

Platform Analytics

File

Persistence

BIOC

Manipulation of default file association configuration When a file is opened, the default program used to open the file, its handler, is checked. File association selections are stored in the Windows Registry and can be edited by users. Malware can modify or create a file association for a given file extension to call another program when a given extension is opened.

Informational

Platform Analytics

Registry

Persistence

BIOC

Manipulation of default file extension configuration Alerts when a handler of a known file extension is modified. Applicable to EXE, DLL, SYS, PS1, BAT, CMD, ZIP and LNK extensions.

Low

Platform Analytics

Registry

Persistence

BIOC

Manipulation of Firefox plugins and extensions via the Registry Plugins and extensions are loaded from all of these Registry keys.

Medium

Platform Analytics

Registry

Persistence

Analytics BIOC

Manipulation of netsh helper DLLs Registry keys Registering netsh helper DLLs is uncommon, and could be used by malware for persistence.

Medium

Platform Analytics

XDR Agent

Persistence

BIOC

Manipulation of service imagepath configuration This key specifies the location of the executable file for the driver or service. Malicious executables might be installed in these paths.

Informational

Platform Analytics

Registry

Persistence

BIOC

Manipulation of the MonitorProcess Registry key Entries added under the Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit can be used to run malicious code and help attackers gain persistence.

Medium

Platform Analytics

Registry

Persistence

BIOC

Manipulation of Winlogon 'Notify' autostart Registry key Since Winlogon handles the Secure Attention Sequence (SAS) (Ctrl+Alt+Del), notify subkeys found at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify are used to notify event handles when SAS happens and load a DLL. This DLL can be edited to launch whenever such a SAS event occurs.

Informational

Platform Analytics

Registry

Persistence

BIOC

Manipulation of Winlogon 'UserInit' autostart Registry key Winlogon process uses the value specified in the UserInit key to launch login scripts etc. This key is location at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon. Usually, UserInit key points to userinit.exe but if this key can be altered, then that EXE will also launch by Winlogon.

Medium

Platform Analytics

Registry

Persistence

Analytics BIOC

Microsoft Office adds a value to autostart Registry key Microsoft Office adds a value to a registry entry (run keys, startup folders) to establish persistence.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

BIOC

Modification of default Windows startup path via Registry An attacker may modify the startup path to the location of the malware.

Informational

Platform Analytics

Registry

Persistence

BIOC

Modification of logon scripts via Registry Windows logon scripts are stored in ``HKCU\Environment\UserInitMprLogonScript`` and trigger when a user logs in. Attackers may abuse them for persistence.

Medium

Platform Analytics

Registry

Persistence

Analytics BIOC

Modification of PAM Modification of PAM configuration files.

Informational

Platform Analytics

XDR Agent

Persistence, Defense Evasion, Credential Access

BIOC

Modification of systemd service files An attacker may create or modify systemd service unit files to establish persistence between reboots.

Informational

Platform Analytics

File

Persistence

BIOC

Modification of the Winlogon\Shell Registry key Malware may modify the Winlogon\Shell Registry value to load itself instead of explorer.exe, which is the default system shell.

Informational

Platform Analytics

Registry

Persistence

BIOC

Multiple RDP sessions enabled via Registry Attackers may allow multiple RDP sessions, so they could access the machine at the same time the user does.

Medium

Platform Analytics

Registry

Persistence, Lateral Movement

BIOC

New entry added to startup related Registry keys by unsigned process Entries added to the "Run Keys" in the Registry or the startup folder will cause the program to be executed when the user logs in. The program will be executed in the context of the user and will have his permissions level.

Informational

Platform Analytics

Registry

Persistence

BIOC

New local user created via PowerShell command line Attackers may create new local users to persist access to machines.

Medium

Platform Analytics

Process execution

Persistence

BIOC

New service created via command line Attackers may leverage services to gain persistence on an endpoint.

Informational

Platform Analytics

Process execution

Persistence

Analytics BIOC

Office process accessed an unusual .LNK file An attacker may embed a .LNK file in an Office document to execute malicious code.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Execution, Persistence

BIOC

Persistence through service registration An attacker may add or modify system services to persist on a host.

Informational

Platform Analytics

File

Persistence

BIOC

Persistence using bashrc files Possible persistency using shell (bash\csh) profile files. Commands in ~/.bashrc are executed on every new shell execution.

Informational

Platform Analytics

File

Persistence

BIOC

Persistence using cron jobs Cron jobs are tasks to be executed sometime in the future, and could be used to persist malware.

Informational

Platform Analytics

File

Persistence

BIOC

Persistence via Registry screensaver key change Attackers may install their malware persistently by modifying the value of the screensaver Registry key.

Informational

Platform Analytics

Registry

Persistence

Analytics BIOC

Phantom DLL Loading An attacker might leverage existing processes missing module loads to load malicious code into trusted processes.

Medium

Platform Analytics

XDR Agent

Persistence

BIOC

Port Monitor added in Registry Adversaries may use port monitors to run an adversary-supplied DLL during system boot for persistence or privilege escalation.

Low

Platform Analytics

Registry

Persistence

Analytics BIOC

Possible DLL Hijack into a Microsoft process An unsigned DLL was loaded into a Microsoft signed process. This DLL name is usually signed by Microsoft, which might indicate an attacker performing DLL Hijacking.

Informational

Platform Analytics

XDR Agent

Persistence, Privilege Escalation, Defense Evasion

Analytics BIOC

Possible DLL Search Order Hijacking An attacker might abuse the Windows DLL search order to trigger known, signed processes to load the attacker's malicious module.

Low

Platform Analytics

XDR Agent

Persistence, Privilege Escalation, Defense Evasion

Analytics BIOC

Possible Persistence via group policy Registry keys Group Policy registry keys were read during system startup. This behavior may indicate a persistence mechanism that triggers on reboot to execute malicious code.

Medium

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

BIOC

Possible web shell command execution Possible command execution via a web shell for reconnaissance.

Informational

Platform Analytics

Process execution

Persistence

Analytics BIOC

Possible webshell file written by a web server process An uncommon file with a web file extension was created, written or renamed by a web server process.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Initial Access, Persistence

BIOC

Possible XDG autostart persistency Possible persistency gained by writing or creating a desktop file inside the xdg autostart directory.

Informational

Platform Analytics

File

Persistence

BIOC

Potential web shell installation A web-app script file was installed on a web server. This can indicate an installation of web shell.

Informational

Platform Analytics

File

Persistence

BIOC

PowerShell creates a new service PowerShell creates a new service via a command line. This can be used by attackers to be persistent on a machine.

Low

Platform Analytics

Process execution

Persistence

BIOC

PowerShell downloads files via BITS This PowerShell argument is often used to run commands with malicious intent.

Medium

Platform Analytics

Process execution

Persistence

BIOC

Print Processor Registration Adversaries may abuse print processors to run malicious DLLs during system boot that will be executed as SYSTEM for privilege escalation and/or persistence.

Low

Platform Analytics

Registry

Persistence

BIOC

Print spooler set to load new DLL on boot Malware can use this technique to load malicious code at startup that will persist on system reboot. This DLL must be located in C:\Windows\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot. A port monitor can be set through the AddMonitor API.

Informational

Platform Analytics

Registry

Persistence

Analytics

Rare access to known advertising domains The endpoint performed many connections to unpopular advertising domains. This could indicate the presence of adware on the endpoint.

Informational

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Command and Control, Persistence

Analytics BIOC

Rare scheduled task created A new rare scheduled task was created with a rare path and a rare command line.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

Rare Scheduled Task RPC activity The endpoint performed abnormal Scheduled Task RPC activity to a remote host.

Informational

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)

Lateral Movement, Persistence

Analytics BIOC

Rare Scheduled Task RPC activity from a rarely seen host The endpoint performed abnormal Scheduled Task RPC activity to a remote host.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)

Lateral Movement, Persistence

Analytics BIOC

Rare service DLL was added to the registry A service was added as a dll, which will be executed by svchost.exe. This is a stealthy technique attackers use to persist their malware.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion, Persistence

Analytics BIOC

Rare unsigned process execution by scheduled task Rare and unsigned process was executed by a scheduled task.

Low

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Scrcons.exe Rare Child Process The Windows Management Instrumentation (WMI) standard event consumer scrcons.exe executed a rare VBScript or PowerShell script. Executing a rare script can be an indication of local or remote code execution abuse by an attacker.

Informational

Platform Analytics

XDR Agent

Execution, Persistence

Analytics BIOC

Screensaver process executed from Users or temporary folder An executable file with a screensaver extension was executed from the Users or temp folder. This is not a common behavior for screensavers and may indicate a malicious file disguised as a screensaver in the Users or temp folder. It is recommended to further investigate the execution flow for malicious indicators.

Low

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Script file added to startup-related Registry keys An attacker may add a script file to the Registry "Run Keys" or the "Winlogon\Userinit" key to cause it to be executed as the user logs in.

Medium

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

SecureBoot was disabled SecureBoot was disabled, this might be indicative of someone trying to install an alternate non-UEFI supported OS.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

Setting Windows Auto Logon by uncommon process Setting Windows Auto Logon by uncommon process.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

BIOC

Shim database file access An attacker may install a malicious SDB (shim database) file on disk for privilege escalation and persistence.

Informational

Platform Analytics

File

Persistence, Privilege Escalation

BIOC

Shim database registration via Registry Application shim databases may be leveraged for privilege escalation and persistence, and can be installed by modifying the Registry.

Informational

Platform Analytics

Registry

Persistence

Analytics BIOC

Signed process creates a scheduled task via file access A signed process created a scheduled task via file access. Attackers may create scheduled tasks for execution and to establish persistence.

Informational

Platform Analytics

XDR Agent

Execution, Persistence

Analytics BIOC

Suspicious active setup registered The endpoint registered a new active setup, which may be used to gain persistence on the host by loading libraries into the time management service.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

Suspicious authentication package registered The endpoint registered a suspicious authentication package, which may be used to gain persistence on the host by loading libraries into the time management service.

Medium

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Suspicious container orchestration job A suspicious orchestration job ran with a rare command line.

Low

Platform Analytics

XDR Agent

Execution, Persistence, Privilege Escalation

Analytics BIOC

Suspicious HTTP parameters detected The endpoint received suspicious HTTP parameters via an HTTP request, which may indicate attempts to exploit server components or web shell activity.

Medium

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Initial Access, Persistence

Analytics BIOC

Suspicious print processor registered The endpoint registered a new print processor, which may be used to gain persistence on the host by loading libraries into the time management service.

Medium

Platform Analytics

XDR Agent

Persistence

BIOC

Suspicious printer driver installation A suspicious process installed a generic printer driver. This may be a sign of CVE-2020-1048, in which an attacker attempts to overwrite a file on the OS.

Low

Platform Analytics

Registry

Privilege Escalation, Persistence

BIOC

Suspicious printer port creation via Registry An attacker may create a print job that prints to a file, overwriting any file on the OS (CVE-2020-1048).

Medium

Platform Analytics

Registry

Privilege Escalation, Persistence

Analytics BIOC

Suspicious process modified RC script file A suspicious process modified an RC script file. These files allow system administrators to map and start custom services at startup for different run levels. This may be done to establish persistence.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Privilege Escalation

Analytics BIOC

Suspicious RunOnce Parent Process Runonce.exe executes commands under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, typically on computer boot and user login events.

Low

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Suspicious runonce.exe parent process Runonce.exe executes commands under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, typically on computer boot and user logon events.

Low

Platform Analytics

XDR Agent

Persistence

BIOC

Suspicious SDB file written to disk Application Shims were created to allow backward compatibility of applications, which can be abused to establish persistence or elevate privileges. The creation of SDB (Shim Database) files may be indicative of this technique.

Informational

Platform Analytics

File

Persistence

BIOC

Suspicious SDB file written to disk by an unsigned process Application Shims were created to allow backward compatibility of applications, which can be abused to establish persistence or elevate privileges. The creation of SDB (Shim Database) files by an unsigned process may be indicative of this technique.

Informational

Platform Analytics

File

Persistence

Analytics BIOC

Suspicious systemd timer activity Suspicious systemd timer activity, which may indicate an attempt to establish persistence.

Low

Platform Analytics

XDR Agent

Execution, Persistence, Privilege Escalation