Elastic Defend high stable eql

AMSI or WLDP Bypass via Memory Patching

Identifies attempts to modify the permissions or write to Microsoft Anti Malware Scan Interface or Windows Lock Down Policy related DLLs from memory. This may indicate an attempt to tamper with certain Windows native protections.

View Source

Detection Logic

api where

 ((process.Ext.api.name in ("VirtualProtect", "VirtualProtectEx") and process.Ext.api.parameters.protection like "?W*") or
  process.Ext.api.name == "WriteProcessMemory") and

 process.Ext.api.summary : ("* amsi.dll*", "* mpoav.dll*", "* wldp.dll*") and 
 process.executable != null and process.parent.executable != null and process.thread.Ext.call_stack_summary : "?*" and
 not process.thread.Ext.call_stack_final_user_module.name in ("Kernel", "Unknown") and
 (
  process.thread.Ext.call_stack_summary like
                    ("ntdll.dll
| kernelbase.dll
| Unbacked",
                     "ntdll.dll
| kernelbase.dll
| Unknown",
                     "ntdll.dll
| kernelbase.dll
| kernel32.dll
| Unbacked",
                     "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| Unbacked",
                     "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| Unbacked
| kernel32.dll
| ntdll.dll", 
                     "ntdll.dll
| kernelbase.dll
| *
| _ctypes.pyd
| python*.dll
| Unknown
| kernel32.dll
| ntdll.dll",
                     "ntdll.dll
| *
| vbe?.dll
| *",
                     "ntdll.dll
| Unknown") or

  endswith~(process.thread.Ext.call_stack_summary, concat("ntdll.dll
| kernelbase.dll
| Unbacked
| ", process.name)) or

  endswith~(process.thread.Ext.call_stack_summary, concat(concat("ntdll.dll
| kernelbase.dll
| Unbacked
| ", process.name), "
| kernel32.dll
| ntdll.dll"))
 ) and
 not (process.code_signature.subject_name in
              ("TPZ SOLUCOES DIGITAIS LTDA", "NedGraphics Software B.V.", "Gerber Technology LLC", "Rocscience Inc.", 
               "Wilcom International Pty Limited", "Code Systems Corporation", "Wilcom Pty Ltd", "Galooli Ltd",
               "MECH-MIND ROBOTICS TECHNOLOGIES LTD.", "COJALI SL") and
      process.code_signature.trusted == true) and
 not process.parent.executable : "?:\\Program Files\\PC SOFT\\WINDEV*\\Programmes\\windev64local.exe" and 
 not process.executable : ("?:\\Program Files\\GRAPHISOFT\\ArchiCAD ??\\ArchiCAD.exe", 
                           "?:\\Program Files\\nQueue\\iAPrintManager\\iAPrintManager.exe", 
                           "?:\\Program Files\\PC SOFT\\WINDEV*\\Programmes\\windev64local.exe", 
                           "?:\\Program Files\\PC SOFT\\WINDEV*\\Programmes\\windev64local.exe",
                           "?:\\Program Files\\Sophos\\Endpoint Defense\\SSPService.exe") and
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.subject_name in ("Bitdefender SRL", "Parallels International GmbH") and $entry.status == "trusted") and
 not process.thread.Ext.call_stack_final_user_module.path like
                                                            ("c:\\windows\\sys?????\\apphelp.dll",
                                                             "c:\\windows\\syswow64\\esensordbi.dll",
                                                             "c:\\program files\\bitdefender\\endpoint security\\bdhkm\\*\\bdhkm64.dll",
                                                             "c:\\program files (x86)\\internet explorer\\ieshims.dll") and
 not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like ("c:\\windows\\sys?????\\ntdll.dll!LdrLoadDll*", "c:\\windows\\sys?????\\kernelbase.dll!LoadLibrary*"))

Field Validations

Loading…

Comments (0)

Loading comments...