Detection Rules | Fibratus

Browse Fibratus detection rules mapped to MITRE ATT&CK.

All rules

• File access to SAM database — Identifies access to the Security Account Manager on-disk database.
• Credential Manager access via known tools — Detects access to the Windows Credential Manager using built-in utilities such as vaultcmd.exe, cmdkey.exe, rundll32.exe…
• LSASS access from unsigned executable — Detects attempts by an unsigned process to access the Local Security Authority Subsystem Service (LSASS). Adversaries m…
• LSASS handle leak via Seclogon — Identifies suspicious access to LSASS process from a callstack pointing to seclogon.dll that may indicate an attempt to …
• LSASS memory dump preparation via SilentProcessExit — Adversaries may exploit the SilentProcessExit debugging technique to conduct LSASS memory dump via WerFault.exe (Windows…
• LSASS memory dump via MiniDumpWriteDump — Identifies access to the Local Security Authority Subsystem Service (LSASS) process to dump the memory via MiniDumpWrite…
• LSASS memory dump via Windows Error Reporting — Adversaries may abuse Windows Error Reporting service to dump LSASS memory. The ALPC protocol can send a message to repo…
• LSASS process clone creation via reflection — Identifies the creation of an LSASS clone process via RtlCreateProcessReflection API function. Adversaries can use this …
• Potential LSASS memory dump — Detects attempts to dump the LSASS process memory to disk for credential extraction. LSASS (Local Security Authority Sub…
• Potential NTLM hash leak via MS Photos — Detects a potential NTLM hash disclosure via abuse of the ms-photos: URI scheme with a UNC path parameter. An attacker c…
• Potential NTLM hash leak via shortcut file — Identifies potential NTLM hash leakage via malicious shortcut (.lnk) file processing. By crafting a .lnk file with a def…
• Registry access to SAM database — Identifies access to the Security Account Manager registry hives.
• Remote thread creation into LSASS — Identifies the creation of a remote thread in LSASS (Local Security And Authority Subsystem Service) by untrusted or sus…
• Sensitive registry hive dump — Identifies an attempt to dump a sensitive registry hive (SAM, SECURITY, or SYSTEM). Adversaries dump these hives to extr…
• Suspicious access to Active Directory domain database — Detects suspicious access to the Active Directory domain database. Adversaries may attempt to access or create a copy of…
• Suspicious access to Unattended Panther files — Identifies suspicious to access to unattend.xml files where credentials are commonly stored within the Panther directory…
• Suspicious access to Windows DPAPI Master Keys — Detects suspicious processes accessing the Windows Data Protection API Master keys which is a sign of potential credenti…
• Suspicious access to Windows Credential Manager files — Identifies suspicious processes trying to acquire credentials from the Windows Credential Manager.
• Suspicious access to Windows Vault files — Identifies attempts from adversaries to acquire credentials from Vault files.
• Suspicious LSA secrets registry access — Identifies access to LSA secrets by suspicious processes that access sensitive SECURITY registry hives associated with c…
• Suspicious LSASS process access — Identifies processes requesting high-privilege access to the Local Security Authority Subsystem Service (LSASS) process …
• Suspicious security package DLL loaded — Attackers can abuse Windows Security Support Provider and Authentication Packages to dynamically inject a Security Packa…
• Suspicious Vault client DLL load — Identifies loading of the Vault client DLL by an unusual process. Adversaries can abuse the functions provided by the C…
• Unusual access to SSH keys — Identifies access by unusual process to saved SSH keys.
• Unusual access to Web Browser Credential stores — Identifies access to Web Browser Credential stores by unusual processes.
• Unusual access to Windows Credential history files — Detects unusual accesses to the Windows Credential history file. The CREDHIST file contains all previous password-linked…
• Activation Context memory section hijacking — Detects abuses of a legitimate Windows feature present in most processes called Activation Contexts with the objective o…
• Activity from unhooked NTDLL module — Detects suspicious activity originating from an unhooked or manually mapped copy of NTDLL loaded into a process. This be…
• AppDomain Manager injection via CLR search order hijacking — Adversaries may execute their own malicious payloads by hijacking how the .NET AppDomainManager loads assemblies. The .…
• BindFlt DLL loaded by an unusual process — Detects the loading of bindfltapi.dll, bindflt.dll, or bindlink.dll DLL family that represents user-mode API surface of …
• CldApi DLL loaded by an unusual process — Detects the loading of cldapi.dll (Cloud Filter API) by processes other than those legitimately associated with Windows …
• Clear Eventlog — Identifies attempts to clear Windows event log stores. Adversaries attempt to evade detection or destroy forensic evide…
• Direct disk device access — Detects direct access to raw disk devices or volumes by user-mode processes, bypassing the Windows filesystem layer. Att…
• DLL loaded via APC queue — Identifies loading of a DLL with a callstack originating from the thread alertable state that led to the execution of an…
• DLL loaded via a callback function — Identifies module proxying as a method to conceal suspicious callstacks. Adversaries use module proxying the hide the or…
• DLL loaded via LdrpKernel32 overwrite — Detects attempts to bypass the standard NTDLL bootstrap process by loading a malicious DLL early through hijacking. The…
• DLL Side-Loading via a copied binary — Identifies when a binary is copied to a directory and shortly followed by the loading of an unsigned DLL from the same d…
• DLL Side-Loading via Microsoft Office dropped file — Identifies Microsoft Office process creating a DLL or other variant of an executable object which is later loaded by a t…
• .NET assembly loaded by unmanaged process — Identifies the loading of the .NET assembly by an unmanaged process. Adversaries can load the CLR runtime inside unmanag…
• Hidden registry key creation — Identifies the creation of a hidden registry key. Adversaries can utilize the native NtSetValueKey API to create a hidde…
• Image load via NTFS transaction — Identifies image loading of a file written to disk via NTFS transaction. Adversaries may exploit the transactional API …
• Potential injection via .NET debugging — Identifies creation of a process on behalf of the CLR debugging facility which may be indicative of code injection. The …
• Potential NTDLL unhooking via file mapping — Identifies processes that map a fresh image view of NTDLL.dll from disk, a behavior commonly associated with user-mode A…
• Potential operation evasion via direct syscall — Identifies processes invoking system operations via direct syscalls. Adversaries and offensive tooling use this techniqu…
• Potential process creation via shellcode — Identifies the creation of a process with stack frames originating from floating memory area while invoking commonly us…
• Potential process injection via tainted memory section — Identifies potential process injection when the adversary creates and maps a memory section with RW protection rights fo…
• Potential shellcode execution via ETW logger thread — Adversaries may employ the undocumented EtwpCreateEtwThread function to execute shellcode within the local process addr…
• Potential shellcode injection via Windows Debugging API — Identifies shellcode injection using the Windows Debugging API and shared memory section. Attackers avoid writing and re…
• Potential thread execution hijacking — Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as possib…
• Process creation from a stomped module — Identifies the creation of the process from the parent where the call stack exhibits suspicious memory properties. The p…
• Process creation via direct syscall — Identifies process creation initiated via direct system call, a technique commonly used by malware to bypass user-mode A…
• Process creation via NTFS transaction — Adversaries may inject malicious code into process by abusing NTFS transactions to avoid writing the final executable im…
• Process execution from hollowed memory section — Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Pr…
• Process execution from remote memory section — Detects execution of a process image originating from a memory section mapped without a backing file, a strong indicator…
• Process execution from a self-deleting binary — Identifies the execution of the process from a self-deleting binary. The attackers can abuse undocumented API functions …
• Process spawned from unusual directory — Detects executions of common utilities or build tools when those binaries are launched from suspicious default Windows d…
• Process spawned via remote thread — Identifies the creation of a process with the parent call stack not revealing normal API functions for process creation.…
• Regsvr32 scriptlet execution — Identifies the execution of a scriptlet file by regsvr32.exe process. regsvr32.exe allows attackers to run arbitrary scr…
• Suspicious access to the hosts file — Identifies suspicious process accessing the Windows hosts file for potential tampering. Adversaries can hijack the hosts…
• Suspicious activity from a reflected process — Detects the execution of a process clone via RtlCreateProcessReflection followed by network activity or loading of commo…
• Suspicious child spawned via reflected process — Identifies the creation of a child via the clone process by employing the RtlCreateProcessReflection or RtlCloneUserProc…
• Suspicious DLL loaded via memory section mapping — Identifies the mapping of a memory section with RX protection followed by unsigned DLL loading. Adversaries may inject d…
• Suspicious HTML Application script execution — Identifies the execution of scripts via Microsoft HTML Application Host interpreter. Adversaries can proxy the executio…
• Suspicious object symbolic link creation — Identifies the creation of the object symbolic link inside the object manager namespace by untrusted or unusual processe…
• Suspicious protected process execution — Identifies unprivileged process spawning a child with protected integrity level. This indicates an unusual behavior tha…
• Suspicious virtual path redirection via bind filter — Detects attempts to open files or directories under security software parent paths where the calling thread's stack show…
• Suspicious Windows Defender exclusions registry modification — Identifies the modification of the Windows Defender process, path, or IP address registry key exclusions by suspicious …
• Suspicious XSL script execution — Identifies a suspicious execution of XSL script via Windows Management Instrumentation command line tool or XSL transfor…
• System Binary Proxy Execution via Rundll32 — Detects the execution of rundll32.exe process with suspicious command line followed by the creation of a possibly malici…
• Thread context manipulation from exception handler — Identifies attempts to manipulate thread context from inside the exception handler. Attackers can hijack execution as pa…
• Thread context set from unbacked memory — Identifies manipulation of the thread context from unbacked memory region. This may be indicative of process injection.
• Unsigned DLL injection via remote thread — Identifies unsigned DLL injection via remote thread creation. Adversaries may inject dynamic-link libraries (DLLs) into …
• Untrusted DLL loaded from unusual directory — Identifies trusted, digitally signed executables loading unsigned or untrusted Dynamic Link Libraries (DLLs) from user-w…
• Windows Defender driver unloading — Detects the unloading of Windows Defender kernel-mode drivers, such as WdFilter.sys or WdBoot.sys, which may indicate an…
• Windows Defender protection tampering via registry — Detects suspicious processes modifying Windows Defender configuration settings via registry to disable protection featu…
• Embedded executable file run via shortcut — Identifies execution of an embedded executable extracted from a shortcut (.lnk) file via script or command interpreters,…
• Embedded script execution via shortcut file — Detects execution of embedded scripts delivered via Windows shortcut (.lnk) files. Adversaries can exploit the attack ch…
• Process execution from compressed file via Explorer — Detects child processes commonly used for code execution that are spawned from compressed files when initiated from Wind…
• Suspicious MSHTA execution via HTML smuggling — Identifies suspicious execution of mshta process initiated by a web browser as part of an HTML smuggling attack chain. T…
• Suspicious process execution from archive via shortcut file — Detects suspicious process execution triggered by a shortcut (.lnk) file extracted from an archive. Adversaries can empl…
• Clickfix phishing via browser dialog box — Identifies a ClickFix-style social-engineering phishing attempt and its FileFix evolution where a web page coerces a use…
• Executable file creation from a macro-enabled Microsoft Office document — Identifies the Microsoft Office process writing an executable file type and the call stack reveals the file creation was…
• Execution via Microsoft Office process — Identifies the execution of the file dropped by Microsoft Office process.
• Macro execution via script interpreter — Identifies the execution of the Windows scripting interpreter spawning a Microsoft Office process to execute suspicious …
• Microsoft Office file execution via script interpreter — Identifies the execution via Windows script interpreter of the executable file written by the Microsoft Office process.…
• Microsoft Office file execution via WMI — Identifies the execution via Windows Management Instrumentation (WMI) of the binary file written by the Microsoft Offic…
• Potential ClickFix infection chain — Identifies the execution of the process via the Run command dialog box, Windows Console shortuct, or Explorer address ba…
• Process spawned from macro-enabled Microsoft Office document — Identifies the execution of the child process spawned by Microsoft Office parent process where the call stack contains t…
• Suspicious DLL loaded by Microsoft Office process — Identifies loading of recently dropped DLL by Microsoft Office process.
• Suspicious execution via WMI from a Microsoft Office process — Identifies a suspicious process execution via Windows Management Instrumentation (WMI) originated from the Microsoft Off…
• Suspicious file delivery via HTML smuggling — Detects suspicious file delivery via HTML smuggling, a phishing technique where malicious payloads are embedded inside …
• Suspicious Microsoft Office embedded object — Identifies Microsoft Office processes dropping a file with suspicious extension and with the call stack indicating opera…
• DLL loading of a file transferred over SMB — Identifies the loading of an unsigned or untrusted DLL shortly after it has been dropped to disk via an SMB file transfe…
• Execution of a file transferred over SMB — Identifies the execution of the binary file that was transferred over SMB. This pattern is characteristic of lateral mov…
• Executable file dropped by an unsigned service DLL — Identifies the loading of an unsigned DLL by svchost process followed by creating an executable file. Adversaries may re…
• Hidden local account creation — Identifies the creation of a hidden local account. Adversaries can create hidden accounts by appending the dollar sign t…
• Network connection via startup folder executable or script — Identifies the execution of unsigned binary or script from the Startup folder followed by network inbound or outbound co…
• Potential mandatory profile registry persistence — Identifies suspicious creation of the NTUSER.MAN file within user profile directories, a lesser-known persistence techni…
• Potential port monitor or print processor persistence via registry modification — Identifies port monitor or print process registry modifications that would allow adversaries to run malicious DLLs durin…
• RID Hijacking — RID (Relative ID part of security identifier) hijacking allows an attacker with SYSTEM level privileges to covertly repl…
• Script interpreter host or untrusted process persistence — Identifies the script interpreter or untrusted process writing to commonly abused run keys or the Startup folder locati…
• Suspicious Microsoft Office add-in loaded — Identifies attempts to load unsigned executables from known Microsoft Office add-ins directories, which adversaries may…
• Suspicious Microsoft Office template — Detects when attackers drop macro-enabled files in specific folders to trigger their execution every time the victim use…
• Suspicious Netsh Helper DLL execution — Identifies the execution of a suspicious Netsh Helper DLL. Adversaries may establish persistence by executing malicious…
• Suspicious persistence via registry modification — Adversaries may abuse the registry to achieve persistence by modifying the keys that are unlikely modified by legitimate…
• Suspicious port monitor loaded — Identifies the loading of an unsigned DLL by the print spool service. Adversaries may use port monitors to run an advers…
• Suspicious print processor loaded — Identifies when the print spooler service loads unsigned or untrusted DLL and the callstack pattern indicates the print …
• Suspicious Startup shell folder modification — Detects when adversaries attempt to modify the default Startup folder path to to circumvent runtime rules that hunt for …
• Unusual file written in Startup folder — Identifies suspicious files written to the startup folder that would allow adversaries to maintain persistence on the en…
• Unusual process modified registry run key — Identifies an attempt by unusual Windows native processes to modify the run key and gain persistence on users logons or …
• Exploitation via Common Log File System — Identifies potential Common Log File System (CLFS) exploitation for privilege escalation by non-SYSTEM processes invokin…
• Fake system root directory creation — Detects attempts to create a fake or malformed Windows system root directory by a unprivileged process, which may indica…
• Fake system root environment variable manipulation — Identifies attempts to manipulate user-scoped Windows directory registry values to point to non-standard locations, a te…
• Potential privilege elevation via arbitrary section creation — Identifies potential privilege escalation attempts where a non-SYSTEM process creates symbolic links targeting object ma…
• Potential privilege escalation via DeadPotato exploit — Detects potential privilege escalation activity consistent with the DeadPotato exploit. Attackers can abuse the DCOM RPC…
• Potential privilege escalation via elevated IFileOperation COM interface — Identifies potential privilege escalation attempts through abuse of the elevated IFileOperation COM interface to bypass …
• Potential privilege escalation via phantom DLL hijacking — Identifies the loading of the phantom DLL that was previously dropped to the System directory. Adversaries may exploit t…
• Suspicious child process integrity level — Identifies the execution of the parent process running with low/medium integrity level that spawns a child process with…
• Suspicious registry symbolic link creation — Detects the creation of registry symbolic links, a technique that allows attackers to redirect registry key lookups to a…
• UAC bypass via assembly Native Image Cache hijack — Detects attempts to bypass User Account Control (UAC) by hijacking the .NET Native Image Cache (NativeImages) through un…
• UAC bypass via CDSSync scheduled task hijack — Identifies attempts to bypass User Account Control (UAC) by hijacking the CDSSync scheduled task through a malicious npm…
• UAC bypass via command handler hijacking — Detects attempts to bypass User Account Control (UAC) by hijacking command handler registry keys associated with auto-el…
• UAC bypass via Control Panel applet execution hijack — Identifies attempts to bypass User Account Control (UAC) by abusing trusted Control Panel execution paths to achieve una…
• UAC bypass via DiskCleanup scheduled task hijack — Detects attempts to bypass User Account Control (UAC) by abusing the built-in Windows Disk Cleanup scheduled task as a p…
• UAC bypass via DLL hijack from Windows Media player directory — Identifies potential User Account Control (UAC) bypass activity through DLL hijacking involving components loaded from t…
• UAC bypass via .NET Code Profiler DLL Hijack — Identifies potential User Account Control (UAC) bypass activity leveraging the .NET Code Profiler mechanism to achieve e…
• UAC bypass via elevated Internet Explorer add-on installer COM interface — Identifies potential User Account Control (UAC) bypass activity involving the elevated Internet Explorer add-on installa…
• UAC bypass via ICMLuaUtil COM interface — Identifies potential User Account Control (UAC) bypass activity through abuse of the ICMLuaUtil Component Object Model (…
• UAC bypass via NTFS junction DLL hijacking — Detects potential User Account Control (UAC) bypass activity leveraging NTFS junctions in combination with DLL hijacking…
• UAC bypass via Program Compatibility Assistant scheduled task hijack — Detects attempts to bypass User Account Control (UAC) by abusing the Program Compatibility Assistant (PCA) scheduled tas…
• UAC bypass via RequestTrace scheduled task hijack — Identifies attempts to bypass User Account Control (UAC) by abusing the RequestTrace scheduled task, a lesser-known but …
• UAC bypass via rouge MMC snap-in — Detects attempts to bypass User Account Control (UAC) by executing a malicious Microsoft Management Console (MMC) snap-i…
• UAC bypass via trusted Windows directory masquerading — Identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory. Adv…
• Untrusted DLL loaded from masqueraded Windows directory — Identifies trusted process executables loading unsigned or untrusted Dynamic Link Libraries (DLLs) from filesystem paths…