AN0913
Analytic 0913
Windows
Detects the presence of executables with high NOP padding, unusually large binary size for their function, and follow-on execution or memory injection from such files, especially when originating from temp or user-space paths.
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=10
WinEventLog:Sysmon
EventCode=1
[NOPThreshold]
High proportion of 0x90 opcodes indicating junk code – tune to suppress noise from some packing tools
[ExecutableSizeThreshold]
Size range for abnormally large binaries relative to their runtime behavior
[TimeWindow]
Window between file creation and execution – short intervals may indicate staged payload execution
AN0914
Analytic 0914
Linux
Detects ELF binaries written to disk that demonstrate anomalous file size or entropy, quickly followed by execution or memory region writes into remote processes (e.g., using ptrace).
auditd:SYSCALL
write
auditd:SYSCALL
execve
auditd:SYSCALL
SYSCALL ptrace/mprotect
[BinarySizeThreshold]
Used to flag binaries much larger than typical shell utilities or payloads
[MemoryWriteTargets]
Which processes are allowed ptrace/mprotect – can limit to suspicious child-to-parent targeting
[ExecutionAfterWriteWindow]
Temporal threshold for file write to execution
AN0915
Analytic 0915
macOS
Identifies Mach-O binaries dropped into temporary directories with abnormally high binary size or padding patterns, followed by privilege escalation, `exec`, or memory mapping of other processes.
macos:endpointsecurity
ES_EVENT_TYPE_NOTIFY_EXEC
macos:endpointsecurity
ES_EVENT_TYPE_NOTIFY_MMAP
macos:endpointsecurity
ES_EVENT_TYPE_NOTIFY_OPEN
[TempFilePaths]
Track dropped executables in ~/Library/, /tmp/, or /private/tmp/
[MachOPaddingThreshold]
Define padding size or section entropy anomalies in Mach-O file format
[FollowOnPrivilegeEscalation]
Detects whether the binary attempts privilege escalation within short execution window