{
  "family": "genericrxau",
  "sample_count": 6,
  "category": "ransomware",
  "description": "Trojan:Win32/Genericrxau (often seen as Trojan:Win32/Generic.rx!au) is not a specific malware family, but rather a **generic heuristic detection** utilized by Microsoft Defender and other AV engines. This detection is triggered when an unknown executable exhibits highly suspicious, malware-like behaviors, despite not matching any known virus signatures. It acts as a critical safety net against zero-day threats, highly obfuscated payloads, and custom, targeted malware.<br><br><b>Understanding Generic Heuristics</b><br>To an end-user, this detection simply appears as a blocked threat. For a security analyst, a Genericrxau detection is a warning sign that requires manual investigation. Because it relies on behavioral analysis or machine learning rather than a precise hash, the underlying threat could be anything: a newly compiled ransomware variant, a custom infostealer used in a targeted attack, or occasionally, a false positive from a poorly written legitimate application.<br><br><b>Triggers and Execution Behaviors</b><br>The Genericrxau heuristic is typically triggered when an executable performs a combination of high-risk actions (`T1204.002`). This includes unpacking code into memory and executing it via Process Hollowing (`T1055.012`), attempting to disable the local firewall or antivirus (`T1562`), dropping executables into sensitive system directories like `System32`, or aggressively modifying the Registry Run keys for persistence (`T1547.001`). The engine analyzes these behaviors dynamically in a sandbox or via API hooking and assigns a risk score. If the score crosses a threshold, it flags the file as Genericrxau.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the true nature of the unknown payload. The primary IoC is the detection itself on a newly introduced file. Because it is a generic detection, relying on file hashes for IoC sharing is often useless (the file is likely uniquely packed). Analysts must rely on dynamic analysis (EDR) to trace the execution chain: What process spawned the file? Did it make outbound network connections? Did it inject into `explorer.exe`?",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1547.001",
    "T1204.002",
    "T1562",
    "T1055.012"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1055.012",
      "name": "Process Injection: Process Hollowing (Triggering the heuristic)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution (Suspicious registry edits)",
      "tactic": "Persistence"
    },
    {
      "id": "T1562",
      "name": "Impair Defenses (Suspicious API calls)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Treat the detection as a high-severity threat until proven otherwise; it could be a zero-day exploit or targeted ransomware.",
    "Isolate the endpoint and review EDR telemetry to understand exactly what behaviors triggered the heuristic flag.",
    "Submit the quarantined executable to a specialized malware analysis sandbox for detonation and deep behavioral analysis.",
    "If the file is deemed a false positive (e.g., a custom in-house application), create a specific exclusion rule based on the file path and certificate, not the hash."
  ],
  "what_to_avoid": [
    "Do not automatically assume a generic detection is a false positive, especially if the file arrived via an external email attachment.",
    "Avoid closing the incident without understanding *why* the file was flagged; the behavioral triggers are often indicative of advanced evasion techniques."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}