Elastic Defend high stable eql

API via Trusted App Runtime DLL

Identifies attemtps to call Windows memory management APIs from the Trusted App Runtime DLL tprtdll.dll. This may indicate an attempt to execute syscalls from a trusted module while avoiding potential NTDLL hooks.

View Source

Detection Logic

api where process.Ext.api.name in ("VirtualAlloc", "VirtualProtect", "WriteProcessMemory","VirtualProtectEx", "VirtualAllocEx") and
 (
  process.thread.Ext.call_stack_summary like "tprtdll.dll
| *" or

  (process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and
   process.thread.Ext.call_stack_final_user_module.protection_provenance_path == "c:\\windows\\system32\\tprtdll.dll") or

   process.thread.Ext.call_stack_final_user_module.path == "c:\\windows\\system32\\tprtdll.dll"
  )

Field Validations

Loading…

Comments (0)

Loading comments...