Elastic Defend high stable eql

API Call from a Suspicious Stack

Identifies the call to some Windows APIs from an unusual call stack. This may be the result of an evasion attempt to hide the origin of the API call from the call stack such as unbacked memory region.

View Source

Detection Logic

api where process.Ext.api.name in ("VirtualAlloc", "VirtualProtect", "WriteProcessMemory", "ResumeThread") and
  process.thread.Ext.call_stack_summary == "ntdll.dll
| kernelbase.dll
| kernel32.dll
| ntdll.dll" and
  not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like
                                                                                ("c:\\windows\\sys?????\\ntdll.dll!LdrLoadDll*",
                                                                                 "c:\\windows\\sys?????\\kernelbase.dll!LoadLibrary*",
                                                                                 "c:\\windows\\sys?????\\kernelbase.dll+0x*",
                                                                                 "c:\\windows\\sys?????\\ntdll.dll+0x*",
                                                                                 "c:\\windows\\sys?????\\kernelbase.dll!MsixIsSystemPackageByPackageFullName*"))

Field Validations

Loading…

Comments (0)

Loading comments...