Rule library
// Detection
Rare process execution
A binary executed that is almost unseen across the estate. Rarity alone is not malice, but it is where unknown tooling surfaces first.
MediumInvestigating0alerts raisedRarity
Armed
What this rule does
Rendered from the stored logic, so it cannot drift from what executes.
processName seen 2 time(s) or fewer across the baseline, where eventType is PROCESS_EXECUTION
{
"kind": "rare_value",
"field": "processName",
"where": [
{
"op": "eq",
"field": "eventType",
"value": "PROCESS_EXECUTION"
}
],
"maxSeen": 2
}Revise
Backtest before saving. Alerts already raised keep their original descriptions: they record what the rule found at the time.
Fields: eventType, username, sourceIp, destinationIp, hostname, processName, commandLine, parentProcess, action, status, country, city
Alerts raised (0)
What this rule has actually caught.
Never fired
Armed, but nothing in the retained window has matched it.
Rule
- Category
- Execution
- ATT&CK tactic
- Execution
- Technique
- T1059
- Kind
- Rarity
- State
- Armed
- Created
- 7d ago
- Last changed
- 7d ago
Firing history
- Total alerts
- 0
- First fired
- Never
- Last fired
- Never
- Escalated to cases
- 0
- Dismissed benign
- 0