Elastic Defend high stable eql

API via Callback from a Suspicious Stack

Identifies the call of Memory Windows APIs indirectly via a callback function. This may be the result of an evasion attempt to hide the origin of the API call from the call stack such as unbacked memory region.

View Source

Detection Logic

api where
 process.Ext.api.name in ("VirtualProtect", "VirtualAlloc", "WriteProcessMemory", "VirtualProtectEx", "VirtualAllocEx", "SuspendThread") and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "C:\\Windows\\System32\\ntdll.dll!TpCallbackIndependent*") and
  process.thread.Ext.call_stack_summary like ("ntdll.dll
| kernelbase.dll
| *
| ntdll.dll
| kernelbase.dll
| ntdll.dll
| kernel32.dll
| ntdll.dll",
                                              "ntdll.dll
| kernelbase.dll
| *
| gdi32full.dll
| kernelbase.dll
| ntdll.dll
| kernel32.dll
| ntdll.dll",
                                              "ntdll.dll
| kernelbase.dll
| *
| gdi32full.dll
| user32.dll
| ntdll.dll
| kernel32.dll
| ntdll.dll")

Field Validations

Loading…

Comments (0)

Loading comments...