AN0983
Analytic 0983
Windows
Detects processes or binaries executed from trusted directories (e.g., System32) or using trusted names (e.g., svchost.exe) where the metadata, hash, or parent process does not align with legitimate activity patterns.
WinEventLog:Security
EventCode=4688
WinEventLog:Sysmon
EventCode=11
[trusted_directory_list]
Paths such as C:\Windows\System32 that adversaries may abuse
[process_baseline_age]
Time window to determine process novelty (e.g., 30 days)
AN0984
Analytic 0984
Linux
Detects renamed binaries or scripts placed into trusted paths like /usr/bin or /lib with mismatched metadata or unexpected creation/modification times.
auditd:SYSCALL
execve
auditd:SYSCALL
open
auditd:SYSCALL
rename
linux:osquery
Filesystem modifications to trusted paths
[monitored_paths]
Set of system or application directories considered sensitive or trusted
[hash_validation_window]
Timeframe during which a newly created file should have its hash validated (e.g., within 5 minutes of write)
AN0985
Analytic 0985
macOS
Detects binaries or launch daemons in /System/Library or /Applications with mismatched bundle names, unexpected metadata, or improper installation origin.
macos:unifiedlog
log collect from launchd and process start
fs:fsusage
filesystem monitoring of exec/open
[expected_bundle_names]
List of known application names and paths to validate against
[signed_by_apple_check]
Toggle to enforce checks for Apple-signed binaries in trusted directories
AN0986
Analytic 0986
Containers
Detects malicious containers or pods using names, labels, or namespaces that mimic legitimate workloads; also checks for image layer mismatches and unauthorized resource deployments.
kubernetes:apiserver
Resource creation and update logs
containerd:events
Docker or containerd image pulls and process executions
[trusted_namespace_list]
List of namespaces that should not be used by unprivileged users or workloads
[image_baseline_hashes]
Reference hashes of approved container images
AN0987
Analytic 0987
ESXi
Detects VIBs, scripts, or binaries placed into directories like /bin or /etc/vmware with names mimicking standard ESXi components. Also monitors unauthorized creation of services.
esxi:vmkernel
Exec
esxi:vmkernel
module load
esxi:hostd
Service events
esxi:hostd
task creation events
[esxi_baseline_file_list]
Known good binaries and their expected paths
[service_creation_alert_threshold]
Threshold for unknown service names or mismatched digital signatures