AN0324
Analytic 0324
Windows
Creation or modification of Windows services or scheduled tasks with names or descriptions mimicking legitimate entries, followed by anomalous execution of untrusted binaries or LOLBAS.
WinEventLog:System
EventCode=7045
WinEventLog:Security
EventCode=4698
WinEventLog:Sysmon
EventCode=1
[TaskNameSimilarityThreshold]
Similarity threshold for comparing new task/service names to known legitimate names (e.g., Levenshtein distance)
[BinaryReputationScore]
Confidence level required for allowing a binary, often from unsigned or untrusted source
[ExecutionContext]
Whether the execution came from SYSTEM, service accounts, or user contexts
AN0325
Analytic 0325
Linux
Creation or modification of `systemd` service units or cron jobs using deceptive naming and untrusted command paths, often followed by lateral network activity or privilege escalation.
auditd:CONFIG_CHANGE
/var/log/audit/audit.log
linux:osquery
scheduled/real-time
linux:cron
cron activity
[UnitFilePath]
Unusual or user-space paths for systemd unit files
[ServiceNameDeviation]
Detect units with names similar to legitimate ones (e.g., `networks.service` instead of `network.service`)
[ExecStartPath]
Track uncommon or suspicious binaries in `ExecStart=` directives
AN0326
Analytic 0326
macOS
Creation of LaunchAgents or LaunchDaemons with names resembling known system services but executing non-Apple signed code or scripts.
fs:fileevents
/Library/LaunchDaemons/*.plist, ~/Library/LaunchAgents/*.plist
macos:endpointsecurity
ES_EVENT_TYPE_NOTIFY_EXEC
macos:unifiedlog
subsystem=com.apple.launchservices
[PlistLabelSimilarity]
Detect plists with labels that closely resemble legitimate ones (e.g., `com.apple.updates.plist`)
[UnsignedBinaryExecution]
Toggle sensitivity for unsigned binaries or scripts launched by daemons
[UserContext]
Scope detection based on whether LaunchAgent ran in user or system context