AN0992
Analytic 0992
Windows
Detect suspicious file creations and process executions triggered by browser activity (e.g., injected payloads written to %AppData% or Temp directories, then executed). Correlate network anomalies with subsequent local process creation or script execution.
WinEventLog:Security
EventCode=4688
WinEventLog:Sysmon
EventCode=11
NSM:Flow
Unexpected script or binary content returned in HTTP response body
[MonitoredExtensions]
File extensions to flag (exe, dll, js, vbs, sh, etc.).
[SuspiciousParentProcesses]
Browser processes (chrome.exe, firefox.exe, edge.exe, etc.) monitored as possible parents for malicious activity.
[RedirectList]
List of suspicious domains or URLs used for malicious redirects.
AN0993
Analytic 0993
Linux
Detect curl/wget commands saving executable/script payloads to /tmp or /var/tmp followed by execution. Monitor packet captures or IDS/IPS alerts for injected responses or mismatched content types.
auditd:SYSCALL
execve: Execution of curl or wget writing files to /tmp/* followed by chmod or execution
WinEventLog:Sysmon
File creation of suspicious scripts/binaries in temporary directories
NSM:Flow
Injected content responses with unexpected script/malware signatures
[TempDirectories]
Directories such as /tmp and /var/tmp where injected files are often written.
AN0994
Analytic 0994
macOS
Monitor unified logs for processes spawned from Safari or other browsers that immediately load scripts or executables. Detect file drops in ~/Library/Caches or ~/Downloads that execute shortly after being written.
macos:unifiedlog
Child processes of Safari, Chrome, or Firefox executing scripting interpreters
macos:unifiedlog
File creation of unsigned binaries/scripts in user cache or download directories
NSM:Flow
Content injection observed in HTTPS responses with mismatched certificates or altered payloads
[MonitoredDirectories]
macOS-specific directories where malicious payloads may be written.