Elastic Defend high stable eql

Binary Proxy Execution via Runexehelper

Identifies the execution of a binary via the Windows RunExeHelper utility. Adversaries may bypass process and signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.

View Source

Detection Logic

process where event.action == "start" and process.parent.name : "runexehelper.exe" and 
 not process.executable :
              ("?:\\Windows\\System32\\conhost.exe",
               "?:\\Windows\\System32\\powercfg.exe",
               "?:\\WINDOWS\\system32\\wevtutil.exe",
               "?:\\Windows\\System32\\WSCollect.exe",
               "?:\\Windows\\System32\\TpmTool.exe",
               "?:\\Windows\\System32\\MdmDiagnosticsTool.exe",
               "?:\\Windows\\System32\\dsregcmd.exe",
               "?:\\Windows\\System32\\stordiag.exe",
               "?:\\Windows\\System32\\dxdiag.exe",
               "?:\\Windows\\System32\\logman.exe",
               "?:\\Windows\\System32\\licensingdiag.exe",
               "?:\\Windows\\System32\\dispdiag.exe",
               "?:\\Windows\\System32\\pnputil.exe",
               "?:\\Windows\\System32\\hcsdiag.exe",
               "?:\\Windows\\System32\\ddodiag.exe")

Field Validations

Loading…

Comments (0)

Loading comments...