AN0949
Analytic 0949
Windows
Monitors for unexpected modifications of system or application binaries, particularly signed executables. Correlates file write events with subsequent unsigned or anomalously signed process execution, and checks for tampered binaries outside normal patch cycles.
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=2
WinEventLog:Security
EventCode=4688
[MonitoredPaths]
Define critical directories (e.g., C:\Windows\System32, Program Files) for binary integrity checks
[SignatureValidation]
Adjust enforcement level of digital signature verification based on enterprise risk appetite
[TimeWindow]
Correlate file modification with subsequent process execution within a defined time window
AN0950
Analytic 0950
Linux
Detects modification of system or application binaries by monitoring /usr/bin, /bin, and other privileged directories. Correlates file integrity monitoring (FIM) events with unexpected process executions or service restarts.
auditd:SYSCALL
open, write
auditd:EXECVE
execve
[WatchedDirectories]
Customize monitored directories (e.g., /usr/bin, /usr/sbin, /opt/apps) for binary tampering
[BaselineHashes]
Maintain golden file hashes for integrity validation
AN0951
Analytic 0951
macOS
Monitors binary modification in /Applications and system library paths. Detects unsigned or improperly signed binaries executed after modification. Tracks Gatekeeper or notarization bypass attempts tied to modified binaries.
macos:unifiedlog
binary modified or replaced
macos:unifiedlog
execution of modified binary without valid signature
[ApplicationPaths]
Tune which application and library directories are monitored for tampering
[SignatureVerificationDepth]
Define strictness of code-signing validation checks
AN0952
Analytic 0952
ESXi
Detects unauthorized modification of host binaries, modules, or services within ESXi. Correlates tampered files with subsequent unexpected service behavior or malicious module load attempts.
esxi:hostd
binary or module replacement event
esxi:vmkernel
unexpected module load
[MonitoredModules]
Define critical ESXi binaries and kernel modules requiring integrity validation
[CorrelationWindow]
Adjust timing correlation between binary modification and module/service anomalies