AN0012
Analytic 0012
Windows
Execution of binaries where the on-disk filename does not match PE metadata such as OriginalFilename or InternalName. Often observed with renamed LOLBAS or system binaries like rundll32, powershell, or psexec.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=11
EDR:AMSI
None
[ImagePath]
Filter by suspicious or non-standard directory paths
[PEInternalNameMismatch]
Enable tuning based on mismatch rules between metadata and disk filename
[CommandLinePattern]
Flag unusual or rare argument combinations for LOLBAS-like tools
AN0013
Analytic 0013
macOS
Execution of renamed or relocated native macOS utilities with uncommon names or non-default paths (e.g., renamed `osascript`, `bash`, or `curl`).
macos:unifiedlog
subsystem=com.apple.process
macos:endpointsecurity
ES_EVENT_TYPE_NOTIFY_EXEC
fs:fileevents
/var/log/quarantine.log
[PathDeviation]
Path deviation from expected directory (e.g., /usr/bin/ vs /tmp/)
[BinaryHashReputation]
Enable tuning based on hash matching known signed versions vs suspicious clones
[UserRole]
Scope detections based on non-admin users using admin-level tools
AN0014
Analytic 0014
Linux
Execution of renamed common utilities (e.g., `bash`, `nc`, `python`, `sh`) from atypical directories or with names intended to deceive defenders or EDRs.
auditd:SYSCALL
execve
linux:osquery
event-based
linux:syslog
cron activity
[ExecutionPath]
Path anomalies such as execution from /dev/shm, /tmp, or user home directories
[ParentProcessContext]
Unusual lineage such as scripts invoking renamed tools
[TimeWindow]
Correlate between file rename and immediate execution