AN1528
Analytic 1528
Windows
Detects the creation or execution of padded binary files (e.g., large size but minimal legitimate content) followed by process execution or lateral movement from the host.
WinEventLog:Security
EventCode=4688
WinEventLog:Security
EventCode=4663, 4670, 4656
WinEventLog:Sysmon
EventCode=11
[FileSizeThresholdMB]
Threshold size in MB to determine suspicious padding
[TimeWindow]
Correlation time window between file creation and execution
[UserContext]
Scope the detection to suspicious or non-standard user accounts
AN1529
Analytic 1529
Linux
Detects abnormal creation of binary files with significant size that are subsequently executed or accessed by non-standard users.
auditd:SYSCALL
open
auditd:SYSCALL
execve
linux:osquery
file_events
[FileSizeThresholdMB]
Defines how large a file must be to consider it padded
[UserContext]
Target abnormal user behavior outside of expected automation
[TimeWindow]
Time window for correlating file creation and execution
AN1530
Analytic 1530
macOS
Monitors for anomalous binary files written to disk with padded size and subsequent execution by user or service context.
macos:unifiedlog
process:spawn
fs:fsusage
file write
[FileSizeThresholdMB]
Padded binary threshold for file size
[TimeWindow]
Detection correlation window for execution after file creation
[UserContext]
Filters for specific users or groups such as admin or service accounts