AN1465
Analytic 1465
Windows
Unusual or suspicious processes loading critical native API DLLs (e.g., ntdll.dll, kernel32.dll) followed by direct syscall behavior, memory manipulation, or hollowing.
WinEventLog:Sysmon
EventCode=7
WinEventLog:Sysmon
EventCode=10
WinEventLog:Sysmon
EventCode=1
[DllName]
May tune DLL filters to focus on low-level API providers (e.g., ntdll.dll)
[Image]
Tune for expected parent processes (e.g., explorer.exe, winlogon.exe)
[TargetProcess]
Scope to suspicious targets like LSASS, csrss, etc.
AN1466
Analytic 1466
Linux
Userland processes invoking syscall-heavy libraries (libc, glibc) followed by fork, mmap, or ptrace behavior commonly associated with code injection or memory manipulation.
auditd:SYSCALL
execve, fork, mmap, ptrace
auditd:SYSCALL
module load or memory map path
[SyscallType]
Filter for fork, mmap, ptrace based on context
[ProcessName]
Whitelist known daemon and scheduled task patterns
[MAPS Path]
Tune suspicious memory map regions (e.g., /tmp/.evilshmem)
AN1467
Analytic 1467
macOS
Execution of processes that link to CoreServices or Foundation APIs followed by creation of memory regions, code execution, or abnormal library injection.
macos:unifiedlog
launch and dylib load
macos:endpointsecurity
ES_EVENT_TYPE_NOTIFY_EXEC
[API Framework Name]
Filter on CoreServices, Cocoa, Foundation framework usage
[Execution Context]
Tune to exclude known developer tools or test environments