AN0024
Analytic 0024
Windows
Correlates unexpected modifications to WMI event filters, scheduled task triggers, or registry autorun keys with subsequent execution of non-standard binaries by SYSTEM-level processes.
WinEventLog:Security
EventCode=4698
WinEventLog:WMI
Creation or modification of __EventFilter, __FilterToConsumerBinding, or CommandLineEventConsumer
WinEventLog:Security
EventCode=4657
WinEventLog:Sysmon
EventCode=1
[UserContext]
Filters triggering on SYSTEM or LOCAL SERVICE vs. user-initiated triggers
[TimeWindow]
Correlates trigger definition and execution timing (e.g., within 5 minutes)
[PathAnomalyThreshold]
Process or binary path deviation scoring for execution anomalies
AN0025
Analytic 0025
Linux
Detects inotify or auditd configuration changes that monitor system files coupled with execution of script interpreters or binaries by cron or systemd timers.
auditd:SYSCALL
Inotify watch creation or auditctl changes on /etc/cron* or /lib/systemd/system/
linux:syslog
Execution of non-standard script or binary by cron
auditd:SYSCALL
Execution of script interpreters by systemd timer (ExecStart)
[ExecutablePathRegex]
Regex defining suspicious binary/script paths triggered by cron/systemd
[WatchTargetPaths]
Paths monitored by auditd/inotify for suspicious event registration
AN0026
Analytic 0026
macOS
Correlates launchd plist modifications with subsequent unauthorized script execution or anomalous parent-child process trees involving user agents.
macos:unifiedlog
Modification of ~/Library/LaunchAgents or /Library/LaunchDaemons plist
macos:unifiedlog
Execution of launchctl with suspicious arguments
[PlistNamePattern]
Regex pattern matching known rogue or unrecognized launchd plist names
[ParentProcessBaseline]
Expected parent-child relationships during plist-triggered execution
AN0027
Analytic 0027
IaaS
Monitors cloud function creation triggered by specific audit log events (e.g., IAM changes, object creation), followed by anomalous behavior from new service accounts.
AWS:CloudTrail
CreateFunction
AWS:CloudTrail
InvokeFunction
[TriggerEventType]
Specific cloud event (e.g., PutObject, CreateRole) that causes function invocation
[ServiceAccountRole]
Expected permissions for roles used in function execution
AN0028
Analytic 0028
SaaS
Correlates Power Automate or similar logic app workflows triggered by SaaS file uploads or email rules with data forwarding or anomalous access patterns.
m365:unified
Creation of Power Automate flow triggered by OneDrive or Exchange event
m365:unified
Automated forwarding or file sync initiated by a logic app
[TriggerCondition]
Event types that initiate SaaS automation (e.g., file add, new email)
[AppIdentityScope]
Scopes/permissions granted to automation app accounts
AN0029
Analytic 0029
Office Suite
Detects macros or VBA triggers set to execute on document open or close events, often correlating with embedded payloads or C2 traffic shortly after execution.
m365:office
VBA auto_open, auto_close, or document_open events
m365:office
External HTTP/DNS connection from Office binary shortly after macro trigger
[MacroFunctionNames]
Names of event-bound functions like Auto_Open that initiate execution
[TimeDeltaMacroToC2]
Time threshold to correlate macro execution with outbound connections