AN0919
Analytic 0919
Windows
Identifies self-modifying executables that exhibit changes in binary hash, entropy, or memory sections during or between executions—often tied to dynamic unpacking or decryption behaviors.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=7
WinEventLog:Sysmon
EventCode=10
[EntropyThreshold]
Tune based on expected baseline entropy for executables; higher values may indicate polymorphic packing.
[TimeWindow]
Correlate rapid process spawn + image load activity suggesting mutation engine usage.
[ParentProcessPatterns]
Define expected or suspicious parent-child chains (e.g., script runner -> encoded PE)
AN0920
Analytic 0920
Linux
Detects files or processes where execution results in frequent re-creation or modification of ELF binaries or interpreter scripts, often using chmod + execve with abnormal entropy.
auditd:SYSCALL
execve
auditd:SYSCALL
mmap
auditd:SYSCALL
chmod
[WriteExecThreshold]
Tune to alert on write followed by chmod + exec in quick succession.
[FileEntropyDeviation]
Detect high deviation from average entropy score of baseline ELF/script files.
[ExecutionFrequency]
Abnormal burst executions of file with identical functionality but varying hash.
AN0921
Analytic 0921
macOS
Tracks modification of executables or interpreter payloads (e.g., Mach-O, dylib) that mutate across runs—using scripting engines, JIT compilers, or side-loaded plugins.
macos:unifiedlog
code signature/memory protection
fs:fsusage
file open/write
macos:endpointsecurity
ES_EVENT_TYPE_NOTIFY_EXEC
macos:endpointsecurity
ES_EVENT_TYPE_NOTIFY_MMAP
[ScriptEnginePatterns]
Detection may vary based on whether Python/Swift/AppleScript is used to mutate payloads.
[MachOEntropyThreshold]
Entropy tuning based on expected baseline for system vs user binaries.
[SignedBinaryChangeRate]
Helps flag apps that change but maintain signed status across invocations.