AN0599
Analytic 0599
Windows
Detection of executables or scripts containing hidden embedded resources or secondary payloads, often with anomalies in file size vs. functionality or dropped child binaries.
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=1
EDR:file
File Metadata Analysis (PE overlays, entropy)
[OverlaySizeThreshold]
Threshold in bytes where appended sections to binaries are considered suspicious
[ProcessTreeDepth]
Controls how far child process lineage is analyzed for dropped embedded payloads
[TimeWindow]
Defines correlation interval between file write and process execution
AN0600
Analytic 0600
Linux
Detection of shell scripts, ELF binaries, or archives containing embedded secondary payloads, self-extracting components, or unusual compression behavior during runtime.
auditd:SYSCALL
open, write
linux:osquery
elf_info, hash, yara_matches
ebpf:syscalls
container_file_activity
[FileSectionCount]
Tuning value for ELF binaries with appended sections or resources
[ScriptLength]
Threshold for long shell scripts with base64-encoded binary content
[ExtractedFileCount]
Number of files written from a single script execution
AN0601
Analytic 0601
macOS
Detection of Mach-O binaries or AppleScripts that contain nested, encoded, or run-only embedded payloads dropped at runtime.
macos:unifiedlog
logd:file write
macos:endpointsecurity
ES_EVENT_TYPE_NOTIFY_EXEC
macos:osquery
mach_o_info, file_metadata
[ScriptFormatType]
Run-only AppleScripts or signed scripting payloads may require scoped detection
[DroppedBinaryCount]
Threshold on number of binaries created by the parent payload
[ParentProcessName]
Allows focusing on suspicious interpreter or staging tools