AN1357
Analytic 1357
Windows
Detects anomalous use of COM, DDE, or named pipes for execution. Correlates creation or access of IPC mechanisms (e.g., named pipes, COM objects) with unusual parent-child process relationships or code injection patterns (e.g., Office spawning cmd.exe via DDE).
WinEventLog:Security
EventCode=4663, 4670, 4656
WinEventLog:Sysmon
EventCode=17
[PipeNamePattern]
Environment-specific pipe names used legitimately vs anomalous (e.g., \\.\pipe\svcctl).
[AllowedParentChildPairs]
Expected parent-child process lineage to minimize false positives (e.g., explorer.exe spawning outlook.exe).
AN1358
Analytic 1358
Linux
Detects abuse of UNIX domain sockets, pipes, or message queues for unauthorized code execution. Correlates unexpected socket creation with suspicious binaries, abnormal shell pipelines, or injected processes establishing IPC channels.
auditd:SYSCALL
socket: Suspicious creation of AF_UNIX sockets outside expected daemons
auditd:SYSCALL
open: Access to named pipes or FIFO in /tmp or /dev/shm by unexpected processes
[SocketPathBaseline]
Expected UNIX socket paths used by system services and applications.
[FIFOAccessPatterns]
Legitimate processes expected to open pipes in shared directories.
AN1359
Analytic 1359
macOS
Detects anomalous use of Mach ports, Apple Events, or XPC services for inter-process execution or code injection. Focuses on unexpected processes attempting to send privileged Apple Events (e.g., automation scripts injecting into security-sensitive apps).
macos:unifiedlog
Unusual Mach port registration or access attempts between unrelated processes
macos:osquery
exec: Unexpected execution of osascript or AppleScript targeting sensitive apps
[AllowedAppleEventTargets]
Whitelisted app-to-app Apple Event communications (e.g., Finder automation).
[MachPortBaseline]
Baseline of Mach ports and XPC services normally used in the environment.