AN0237
Analytic 0237
Windows
Detection of processes that load or decode encrypted/encoded files in memory and subsequently execute or inject them, indicating payload unpacking or memory-resident malware.
WinEventLog:Sysmon
EventCode=7
WinEventLog:Sysmon
EventCode=10
WinEventLog:Security
EventCode=4688
[Image]
Path of decoder utilities (e.g., certutil.exe, powershell.exe) can vary across environments.
[CommandLine]
Base64/hex strings used may change per encoded payload.
[TimeWindow]
The duration between file decode and execution may differ across implementations.
AN0238
Analytic 0238
Linux
Detection of suspicious use of shell utilities or scripts that decode or decrypt a payload and execute it without writing to disk.
auditd:SYSCALL
execve
linux:Sysmon
EventCode=3, 22
[UserContext]
Normal usage of `base64`, `openssl`, or `gpg` varies by user/role.
[ProcessLineage]
Parent-child process chains may differ across deployments.
[TimeWindow]
Time between decode and execution is implementation-specific.
AN0239
Analytic 0239
macOS
Detection of encoded payloads being decoded and executed in-memory using scripting tools or third-party decoders.
macos:unifiedlog
log stream
macos:endpointsecurity
es_event_exec
macos:unifiedlog
memory mapping
[ScriptContent]
Encoded payload content varies across adversaries.
[ExecutionChain]
Sequence of tools or scripts executed can differ.
[UserContext]
May depend on whether user is admin, daemon, or system account.