Identifies self-modifying executables that exhibit changes in binary hash, entropy, or memory sections during or between executions—often tied to dynamic unpacking or decryption behaviors.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 |
| Module Load (DC0016) | WinEventLog:Sysmon | EventCode=7 |
| Process Access (DC0035) | WinEventLog:Sysmon | EventCode=10 |
| Field | Description |
|---|---|
| EntropyThreshold | Tune based on expected baseline entropy for executables; higher values may indicate polymorphic packing. |
| TimeWindow | Correlate rapid process spawn + image load activity suggesting mutation engine usage. |
| ParentProcessPatterns | Define expected or suspicious parent-child chains (e.g., script runner -> encoded PE) |
Detects files or processes where execution results in frequent re-creation or modification of ELF binaries or interpreter scripts, often using chmod + execve with abnormal entropy.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | execve |
| Module Load (DC0016) | auditd:SYSCALL | mmap |
| File Modification (DC0061) | auditd:SYSCALL | chmod |
| Field | Description |
|---|---|
| WriteExecThreshold | Tune to alert on write followed by chmod + exec in quick succession. |
| FileEntropyDeviation | Detect high deviation from average entropy score of baseline ELF/script files. |
| ExecutionFrequency | Abnormal burst executions of file with identical functionality but varying hash. |
Tracks modification of executables or interpreter payloads (e.g., Mach-O, dylib) that mutate across runs—using scripting engines, JIT compilers, or side-loaded plugins.
| Data Component | Name | Channel |
|---|---|---|
| Process Metadata (DC0034) | macos:unifiedlog | code signature/memory protection |
| File Creation (DC0039) | fs:fsusage | file open/write |
| Process Creation (DC0032) | macos:endpointsecurity | ES_EVENT_TYPE_NOTIFY_EXEC |
| Process Modification (DC0020) | macos:endpointsecurity | ES_EVENT_TYPE_NOTIFY_MMAP |
| Field | Description |
|---|---|
| ScriptEnginePatterns | Detection may vary based on whether Python/Swift/AppleScript is used to mutate payloads. |
| MachOEntropyThreshold | Entropy tuning based on expected baseline for system vs user binaries. |
| SignedBinaryChangeRate | Helps flag apps that change but maintain signed status across invocations. |