AN0355
Analytic 0355
Windows
Adversary renames LOLBINs or deploys binaries with spoofed file names, internal PE metadata, or misleading icons to appear legitimate. File creation is followed by execution or service registration inconsistent with known usage.
WinEventLog:Sysmon
EventCode=1
WinEventLog:System
EventCode=7045
[OriginalFilenameMismatch]
Compare executable file name with PE metadata OriginalFilename field
[KnownSystemUtilityPaths]
Tune based on expected installation directories for signed binaries
[TimeWindow]
Correlation window between file creation and service/process execution
AN0356
Analytic 0356
Linux
Adversary drops renamed binaries in uncommon directories (e.g., /tmp, /dev/shm) or uses special characters in names (e.g., trailing space, Unicode RLO). Execution or cronjob registration follows shortly after file drop.
auditd:SYSCALL
execve
linux:syslog
rename
linux:osquery
file_events
[DropLocationPattern]
Directories where new binaries are suspicious (e.g., /tmp)
[FilenameAnomalies]
Regex for Unicode/RLO/space abuse in filenames
[ExecutionDelayWindow]
Time range between file write and execution used for joining
AN0357
Analytic 0357
macOS
Adversary creates disguised launch daemons or apps with misleading names and bundle metadata (e.g., Info.plist values inconsistent with binary path or icon). Launch is correlated with user logon or persistence setup.
macos:unifiedlog
process
macos:endpointsecurity
ES_EVENT_TYPE_NOTIFY_EXEC
fs:fileevents
/var/log/install.log
[InfoPlistDiscrepancy]
Mismatch between bundle metadata and file system path/name
[LaunchAgentPath]
Unusual LaunchDaemon/LaunchAgent paths can be tuned per org
[ExecutionTrigger]
Window between install and first execution (e.g., at user login)
AN0358
Analytic 0358
Containers
Adversary uses renamed container images, injects files into containers with misleading names or metadata (e.g., renamed system binaries), and executes them during startup or scheduled jobs.
containerd:runtime
/var/log/containers/*.log
docker:events
docker.events.json
ebpf:syscalls
file_write
[ImageLabelMismatch]
Tune detection based on mismatch between image name and labels
[StartupScriptLocation]
Detect binaries added or modified in startup path (e.g., /entrypoint.sh)
[ProcessNamePattern]
Allow tuning based on suspicious binary naming inside containers
AN0359
Analytic 0359
ESXi
Adversary places scripts or binaries with misleading names in /etc/rc.local.d or /var/spool/cron, or registers services with legitimate-sounding names not present in default ESXi builds.
esxi:hostd
registers services with legitimate-sounding names
esxi:shell
scripts or binaries with misleading names
[ServiceNameBaseline]
Tune based on default service names vs. suspicious new entries
[ScriptFilePath]
Watch for new binaries/scripts in boot or cron folders
[ExecutionContext]
Determine if execution happens at boot or scheduled interval