AN1216
Analytic 1216
Windows
Detects the relocation of malicious executables via copy/move actions across suspicious folders (e.g., from Downloads to System32), followed by deletion of the original source or renaming to blend into legitimate binaries.
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=23
[SuspiciousTargetPathRegex]
Patterns like \Windows\*, \System32\*, or temp+execution directories
[TimeWindow]
Correlate copy+rename+delete chains within 5-minute window
[FileExtensionFilter]
Limit to .exe, .dll, .js, .bat unless context suggests otherwise
AN1217
Analytic 1217
Linux
Detects binary movement or copying between untrusted and trusted paths (e.g., /tmp/ → /usr/bin/ or /etc/init.d/) that may indicate persistence attempts or cleanup of origin traces.
auditd:SYSCALL
PATH
[RelocationPathPatterns]
Match movement into known persistence or exclusion directories
[BinaryEntropyThreshold]
Apply threshold to detect high-entropy relocations (e.g., packed malware)
AN1218
Analytic 1218
macOS
Detects movement of binaries to `~/Library/`, `/System/`, or app bundle locations, especially after initial execution or download from Safari or Mail.
macos:unifiedlog
log stream
macos:osquery
file_events
[TargetBundlePathPattern]
Monitor relocation to .app/Contents/MacOS/ or ~/Library/Launch*
[QuarantineFlagCheck]
Check for disappearance of com.apple.quarantine attribute post-move
AN1219
Analytic 1219
Network Devices
Detects firmware or script relocation attempts (e.g., CLI-based `copy`, `move`, or `rename`) between temporary partitions and config startup folders on routers or switches.
networkdevice:syslog
command audit
[StartupConfigPath]
Targeted config folders like flash:/startup-config or nvram:
[CommandPatternMatch]
e.g., `copy tftp flash`, `rename`, `move flash:/old.bin flash:/new.bin`