AN0973
Analytic 0973
Windows
Detects abuse of fileless storage mechanisms such as Registry keys, WMI classes, and Event Logs used to stage payloads, scripts, or encoded content outside traditional files.
WinEventLog:Security
EventCode=4657
WinEventLog:Application
WMI Object Creation Events
[RegistryPathFilter]
Scoped to suspicious or abused paths like HKCU\Software\Classes\ or HKLM\SYSTEM\CurrentControlSet\Services\
[PayloadEntropyThreshold]
Minimum entropy level to flag suspicious registry or WMI content as encoded payloads
[TimeWindow]
Temporal window for correlating WMI/registry modifications with process creation or network usage
AN0974
Analytic 0974
Linux
Detects usage of shared memory directories (/dev/shm, /run/shm) for temporary storage of obfuscated, encoded, or executable data without persistence to disk.
auditd:SYSCALL
open, write, unlink
linux:osquery
file_events.path
[PathPrefix]
Shared memory mount path used (e.g., /dev/shm/ or /run/shm/)
[FilenameRegex]
Regex to match non-standard, suspicious, or encoded filenames
[ExecCorrelationWindow]
Time window to correlate process execution from shared memory directories