AN1097
Analytic 1097
Windows
Monitor for runtime data manipulations by detecting suspicious modification of application binaries, API hooking, or unexpected behavior from processes responsible for rendering or displaying data. Correlate registry edits, process creation, and unexpected binary hash mismatches.
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=15
WinEventLog:Security
EventCode=4657
[MonitoredPaths]
Directory paths of business-critical applications where runtime manipulations are most impactful.
[HashBaseline]
Expected cryptographic hashes of application binaries used for runtime data display.
AN1098
Analytic 1098
Linux
Detect runtime manipulation by monitoring system calls for modifications to shared libraries, ELF binaries, or environment variables that affect how data is displayed. Look for suspicious writes to application directories and mismatch in binary integrity baselines.
auditd:SYSCALL
open, write: File writes to application binaries or libraries at runtime
linux:syslog
Execution of modified binaries or abnormal library load sequences
[WatchedBinaries]
Specific critical application binaries or libraries to monitor for unauthorized changes.
[IntegrityCheckFrequency]
Interval for verifying hashes of executables and libraries.
AN1099
Analytic 1099
macOS
Monitor for runtime manipulation by observing changes in application bundles, unexpected signing modifications, and runtime API calls that inject or alter how data is displayed. Detect alterations in CFNetwork or CoreFoundation frameworks responsible for rendering data.
macos:unifiedlog
Unexpected application binary modifications or altered signing status
macos:osquery
CALCULATE: Mismatch in file integrity of critical macOS applications
[AllowedApps]
Whitelisted applications expected to handle sensitive runtime data.
[SignatureEnforcement]
Policy enforcement for validating application code signing integrity.