AN0066
Analytic 0066
Windows
Detection of unpacking behavior through abnormal memory allocation, followed by executable code injection and execution from non-image sections.
WinEventLog:Sysmon
EventCode=10
WinEventLog:Sysmon
EventCode=1
[ParentProcessName]
To scope detections to suspicious parent-child process relationships typical of loaders or droppers.
[AllocationSizeThreshold]
To tune for unusually large virtual memory allocations that might indicate unpacked payloads.
AN0067
Analytic 0067
Linux
Correlates ELF file execution with high-entropy writable memory segments and self-modifying code patterns.
auditd:SYSCALL
execve
auditd:SYSCALL
mprotect
[EntropyThreshold]
Useful for tuning unpacked sections containing high entropy indicative of compression or encryption.
[TimeWindow]
Can be tuned to correlate file writes to execution within a set timeframe.
AN0068
Analytic 0068
macOS
Detection of packed Mach-O binaries unpacking into memory and transferring control to dynamically modified code segments.
macos:unifiedlog
process::exec
macos:endpointsecurity
ES_EVENT_MMAP
[SignedBinaryContext]
Helps to distinguish between signed/unsigned packed binaries (common in legitimate vs. malicious cases).
[UserContext]
Can be used to scope to specific users or service accounts targeted in attacks.