Elastic Defend high stable eql

AllowProtectedRenames Registry Modification

Identifies attempts to enable the modification of Trusted Installer protected resources via PendingFileRename operation. Malware may change this setting to hijack existing resources for execution and persistence.

View Source

Detection Logic

registry where process.name != null and
 registry.value : "AllowProtectedRenames" and registry.data.strings : "1" and 
 not process.executable : ("?:\\Program Files\\*", "?:\\Program Files (86)\\*", "\\Device\\Mup\\lansweeper\\*$\\uninstall_flash_player.exe") and
 not (process.code_signature.status : "trusted" and not process.code_signature.subject_name : "Microsoft*")

Field Validations

Loading…

Comments (0)

Loading comments...