AN1440
Analytic 1440
Windows
Detects suspicious use of PowerShell, .NET, or script interpreters to spawn processes that mimic UAC prompts, often with credential capture dialogue boxes invoked from non-standard parent processes.
WinEventLog:Sysmon
EventCode=1
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
[CommandLine]
Tunable to detect suspicious prompts like 'Enter your password' or 'CredentialRequired'
[ParentProcessName]
Tune to flag UI prompts spawned from unexpected processes like cmd.exe or user scripts
[TimeWindow]
Scope correlation of script execution and prompt appearance
AN1441
Analytic 1441
Linux
Detects GUI-based credential prompts invoked via zenity/kdialog/dialog or X11 APIs from non-user-facing scripts or background shell sessions, often with authentication-related text.
auditd:SYSCALL
execve
linux:cli
Terminal Command History
[ExecutableName]
Filter zenity/kdialog prompts launched from unexpected parent shells
[PromptString]
Look for 'password', 'authentication required', or similar tokens
AN1442
Analytic 1442
macOS
Detects AppleScript or Objective-C usage to generate fake authentication windows (e.g., using display dialog or NSAlert) from user-launched or persistence-related processes.
macos:unifiedlog
subsystem=com.apple.Security or com.apple.applescript
macos:osquery
process_events
[ScriptContent]
AppleScript snippets like 'display dialog' or 'with hidden answer'
[ProcessPath]
Tune out Apple-signed and expected automation tasks