Elastic Defend high stable eql

API Call from Inaccessible Memory Page

Identifies API calls from memory regions unexpectedly marked as inaccessible. This may indicate an attempt to hide injected code from memory scanners.

View Source

Detection Logic

api where
 process.Ext.api.name in ("VirtualProtect", "VirtualAlloc", "SetThreadContext", "MapViewOfFile", "MapViewOfFile2") and
 (process.thread.Ext.call_stack_final_user_module.name == "Unbacked" or
  process.thread.Ext.call_stack_final_user_module.allocation_private_bytes >= 100000) and
 _arraysearch(process.thread.Ext.call_stack, $entry,
              $entry.symbol_info == "Unbacked" and $entry.callsite_trailing_bytes like ("NOACCESS*", "GUARD*"))

Field Validations

Loading…

Comments (0)

Loading comments...