AN0609
Analytic 0609
Windows
Unusual modifications to service binary paths, registry keys, or DLL load paths resulting in alternate execution flow. Defender observes registry key modifications, suspicious file writes into system directories, and processes loading libraries from abnormal paths.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=7
WinEventLog:Security
EventCode=4657
WinEventLog:Sysmon
EventCode=11
[ServiceBaseline]
Expected registry keys and service paths for comparison.
[AllowedDllPaths]
Directories considered valid for DLL loading.
[TimeWindow]
Correlation interval between registry/file modification and process execution.
AN0610
Analytic 0610
Linux
Adversary manipulation of shared library paths, environment variables, or replacement of service binaries. Defender observes suspicious modifications in /etc/ld.so.preload, service config changes, or file writes replacing existing executables.
auditd:SYSCALL
open/write syscalls targeting /etc/ld.so.preload or binaries in /usr/bin
linux:syslog
Service restart with modified executable path
linux:osquery
Process execution with LD_PRELOAD or modified library path
[MonitoredDirectories]
Directories where binary replacement should trigger alerts.
[EnvVarMonitors]
Environment variables like LD_PRELOAD or PATH to monitor.
AN0611
Analytic 0611
macOS
Abuse of DYLD_INSERT_LIBRARIES or hijacking framework paths for malicious libraries. Defender observes processes invoking abnormal dylibs, modified plist files, or persistence entries pointing to altered binaries.
macos:unifiedlog
Execution of process with DYLD_INSERT_LIBRARIES set
macos:unifiedlog
Modified application plist or binary replacement in /Applications
macos:unifiedlog
Dylib loaded from abnormal location
[AllowedDylibPaths]
Baseline directories for dylib loading.
[PlistMonitors]
Specific plist files used for persistence monitoring.