Detection of executables or scripts containing hidden embedded resources or secondary payloads, often with anomalies in file size vs. functionality or dropped child binaries.
| Data Component | Name | Channel |
|---|---|---|
| File Creation (DC0039) | WinEventLog:Sysmon | EventCode=11 |
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 |
| File Metadata (DC0059) | EDR:file | File Metadata Analysis (PE overlays, entropy) |
| Field | Description |
|---|---|
| OverlaySizeThreshold | Threshold in bytes where appended sections to binaries are considered suspicious |
| ProcessTreeDepth | Controls how far child process lineage is analyzed for dropped embedded payloads |
| TimeWindow | Defines correlation interval between file write and process execution |
Detection of shell scripts, ELF binaries, or archives containing embedded secondary payloads, self-extracting components, or unusual compression behavior during runtime.
| Data Component | Name | Channel |
|---|---|---|
| File Modification (DC0061) | auditd:SYSCALL | open, write |
| File Metadata (DC0059) | linux:osquery | elf_info, hash, yara_matches |
| File Access (DC0055) | ebpf:syscalls | container_file_activity |
| Field | Description |
|---|---|
| FileSectionCount | Tuning value for ELF binaries with appended sections or resources |
| ScriptLength | Threshold for long shell scripts with base64-encoded binary content |
| ExtractedFileCount | Number of files written from a single script execution |
Detection of Mach-O binaries or AppleScripts that contain nested, encoded, or run-only embedded payloads dropped at runtime.
| Data Component | Name | Channel |
|---|---|---|
| File Creation (DC0039) | macos:unifiedlog | logd:file write |
| Process Creation (DC0032) | macos:endpointsecurity | ES_EVENT_TYPE_NOTIFY_EXEC |
| File Metadata (DC0059) | macos:osquery | mach_o_info, file_metadata |
| Field | Description |
|---|---|
| ScriptFormatType | Run-only AppleScripts or signed scripting payloads may require scoped detection |
| DroppedBinaryCount | Threshold on number of binaries created by the parent payload |
| ParentProcessName | Allows focusing on suspicious interpreter or staging tools |