AN0540
Analytic 0540
Windows
Detection of known tools or malware flagged by antivirus, followed by a near-term drop of a similar binary with modified signature and resumed activity (execution, C2, or persistence).
WinEventLog:Application
EventCode=1000
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=11
[AVAlertMessage]
Vendor-specific signature string or detection message that can be correlated to threat intel context.
[TimeWindow]
The time between AV alert and similar file/process activity (e.g., 5–30 minutes)
[FilenameSimilarityThreshold]
String or hash similarity thresholds between original and modified binary.
AN0541
Analytic 0541
Linux
Detection of anti-malware quarantining or flagging a tool, followed by a new binary written to disk with a similar function or name and a resumed process chain.
auditd:SYSCALL
execve
auditd:SYSCALL
open, rename
linux:osquery
file_events
EDR:detection
ThreatDetected, QuarantineLog
[PathWatchlist]
Tunable list of directories often abused for dropped binaries (e.g., /tmp, ~/.cache, /opt/soft/).
[ProcessAncestryDepth]
Limit how far up the tree to trace tool modification behavior for detection.
AN0542
Analytic 0542
macOS
Detection of XProtect or AV quarantining a known tool, followed by modification (file size, hash, string) and subsequent re-execution by the same or related user.
macos:unifiedlog
quarantine or AV-related subsystem
macos:osquery
file_events
[BinaryChangeThreshold]
File hash delta or binary string diff score to tolerate renamed/mutated variants.
[UserContext]
User or group expected to use dev tools; reduce false positives from legitimate repacking.