AN0311
Analytic 0311
Windows
Monitoring modification and execution of user or system logon scripts such as in registry Run keys or startup folders.
WinEventLog:Security
EventCode=4688
WinEventLog:Security
EventCode=4657
WinEventLog:TaskScheduler
EventCode=106
[TargetObject]
Registry path that may vary by user or policy configuration.
[ParentProcessName]
Can be tuned to known parent processes to reduce false positives.
[TimeWindow]
Logon activity clustered during specific user shifts.
AN0312
Analytic 0312
Linux
Detection of changes or execution of shell initialization scripts like .bashrc, .profile, or /etc/profile for persistence.
auditd:SYSCALL
EXECVE
auditd:PATH
PATH
linux:osquery
file_events
[FilePath]
Initialization script path that can differ across user and system profiles.
[UserContext]
User-level vs root-level configuration.
[TimeWindow]
Useful to correlate between file change and subsequent execution.
AN0313
Analytic 0313
macOS
Monitoring for modification and execution of login hook scripts or LaunchAgents/LaunchDaemons used for persistence.
macos:unifiedlog
log
fs:fsusage
file
macos:osquery
launchd
[Label]
LaunchAgent or LaunchDaemon label name, often environment-specific.
[ProgramArguments]
Arguments passed to scripts, which may need tuning by environment.
[UserContext]
Distinguish between user login and system startup agents.
AN0314
Analytic 0314
ESXi
Detection of modification to ESXi rc.local.d or rc scripts that are used to execute on boot.
esxi:vmkernel
boot
esxi:hostd
boot
[ScriptName]
Script path or name may vary across hypervisor versions.
[LogSeverity]
Log verbosity settings may alter visibility of activity.
AN0315
Analytic 0315
Network Devices
Detection of changes to device startup-config files that include boot scripts or scheduled execution routines.
networkdevice:syslog
config
[Interface]
Affected interface or subsystem; varies per device.
[CommandPattern]
Patterns of authorized config changes differ by vendor or policy.