Identifies a suspicious Conhost child process which may be an indication of code injection activity.

Read More

Identifies process execution events where the command line value contains a long sequence of whitespace characters or multiple occurrences of contiguous whitespace. Attackers may attempt to evade signature-based detections by padding their malicious command with unnecessary whitespace characters. These observations should be investigated for malicious behavior.

Read More

Adversaries may attempt to disable the iptables or firewall service in an attempt to affect how a host is allowed to receive or send network traffic.

Read More

Identifies mshta.exe making a network connection. This may indicate adversarial activity, as mshta.exe is often leveraged by adversaries to execute malicious scripts and evade detection.

Read More

Adversaries may encode/decode data in an attempt to evade detection by host- or network-based security controls.

Read More

Adversaries may encode/decode data in an attempt to evade detection by host- or network-based security controls.

Read More

Identifies possibly suspicious activity using trusted Windows developer activity.

Read More