AN0764
Analytic 0764
Windows
Correlation of registry key modification for Run/RunOnce with abnormal parent-child process relationships and outlier execution at user logon or system startup
WinEventLog:Security
EventCode=4688
WinEventLog:Sysmon
EventCode=13, 14
[ParentProcessName]
Customize based on expected parent-child process lineage for autostarts
[StartupRegistryPath]
May vary based on organization policy or installed software
AN0765
Analytic 0765
Linux
Correlates creation/modification of systemd service files or /etc/init.d scripts with outlier process behavior during boot
auditd:SYSCALL
creat
auditd:SYSCALL
write
auditd:SYSCALL
Execution of binaries located in /etc/init.d/ or systemd service paths
[FilePath]
Organizations may use different init systems or custom startup paths
[UserContext]
Autostart scripts should run as root or system users; deviations are suspect
AN0766
Analytic 0766
macOS
Observes creation or modification of LaunchAgent/LaunchDaemon property list files combined with anomalous plist payload execution after user logon
macos:unifiedlog
Observed loading of new LaunchAgent or LaunchDaemon plist
macos:unifiedlog
write
macos:unifiedlog
Execution of binary listed in newly modified LaunchAgent plist
[PlistKey]
Organizations may use specific keys or additional payload parameters
[TimeWindow]
Tunable based on expected delay between plist write and execution