Elastic Defend high stable eql

AMSI Bypass via Unbacked Memory

Identifies attempts to modify the permissions or write to Microsoft Anti Malware Scan Interface DLL from unbacked memory.

View Source

Detection Logic

api where process.Ext.api.summary : "* amsi.dll*" and 
 ((process.Ext.api.name in ("VirtualProtect", "VirtualProtectEx") and process.Ext.api.parameters.protection like "?W*") or
  process.Ext.api.name == "WriteProcessMemory") and
 process.executable != null and process.thread.Ext.call_stack_summary like "?*" and process.thread.Ext.call_stack_final_user_module.name != null and
 process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and
 process.thread.Ext.call_stack_final_user_module.protection_provenance != null and 
 not process.thread.Ext.call_stack_final_user_module.protection_provenance like ("Kernel", "Kernel
| *") and
 not (process.thread.Ext.call_stack_summary == "Unbacked" and process.thread.Ext.call_stack_final_user_module.protection_provenance == "Unbacked") and
 process.thread.Ext.call_stack_final_user_module.hash.sha256 != "07e82c4bc4f48e94a634480ff5140b94b2026a7716473867806355957dc4d291" and
 not process.parent.executable : "C:\\Program Files (x86)\\Steam\\steamapps\\common\\BattleBit Remastered\\EasyAntiCheat.exe" and
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and
                  $entry.subject_name in ("Microsoft Windows Hardware Compatibility Publisher", "Microsoft Windows Software Compatibility Publisher")) and
 not (process.executable : "?:\\Windows\\Microsoft.NET\\Framework\\*\\ngen.exe" and
      process.thread.Ext.call_stack_summary == "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| Unbacked
| protector32.dll")

Field Validations

Loading…

Comments (0)

Loading comments...