Elastic Defend high stable eql

CrashDump Disabled via Registry Modification

Identifies attempt to disable memory crashdump via registry modification. Malware using kernel mode component may perform this action to limit exposure in the case of an unexpected system crash.

View Source

Detection Logic

registry where registry.value : "CrashDumpEnabled" and registry.data.strings : "0" and
 process.executable != null and
 not (user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and 
      process.executable : ("?:\\Windows\\System32\\svchost.exe", "?:\\Windows\\System32\\msiexec.exe")) and
 not process.executable : (
       "?:\\Windows\\System32\\SystemPropertiesAdvanced.exe",
       /* TBR */
       "?:\\Program Files (x86)\\Citrix\\Workspace Environment Management Agent\\Citrix.Wem.Agent.Service.exe")

Field Validations

Loading…

Comments (0)

Loading comments...