Elastic Defend high stable eql

Binary Proxy Execution via AppVLP

Identifies the execution of a binary via the Application Virtualization Utility. Adversaries may bypass process and signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.

View Source

Detection Logic

process where event.action == "start" and process.parent.name : "AppVLP.exe" and
 not process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
 not (process.name : "rundll32.exe" and process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
 process.hash.sha256 != "de40cd43ec9934769c830bd3d4bc4a5a3fd5ed0535fa8ce4fdb17be3301fc120"

Field Validations

Loading…

Comments (0)

Loading comments...