title: Malicious Behavior Detection
id: d4d56bc1-240b-58e9-a427-d06211773eee
custom_id: wf-mal-001
status: stable
level: high
description: |
    Detects events classified as malicious behavior by WitFoo's enrichment engine.
    This covers a broad range of malware indicators including suspicious process
    execution, anomalous system calls, and behavioral analysis triggers.
author: WitFoo
date: 2026-02-21
tags:
    - attack.execution
    - attack.t1027
references:
    - https://attack.mitre.org/techniques/T1027/
logsource:
    product: witfoo
    service: artifact-exporter
detection:
    selection:
        messageType: "malicious_behavior"
    condition: selection
fields:
    - clientIP
    - serverIP
    - program
    - fileName
    - fileHash
    - matchedLeadRules
    - severityLabel
falsepositives:
    - Legitimate penetration testing tools
    - Security research and malware analysis environments