Elastic Defend high stable eql

DLL Injection via MavInject Utility

Detects the utilization of the Microsoft MavInject utility to inject an arbitrary library into a remote process.

View Source

Detection Logic

sequence with maxspan=5s 
 [process where event.action == "start" and
  (process.pe.original_file_name : "mavinject*.exe" or process.name : "mavinject*.exe") and 
   process.args : "/INJECTRUNNING" and not process.parent.executable : "?:\\Windows\\Sys*\\AppVClient.exe"] as event0
 [library where process.pid != 4 and not dll.code_signature.status : "trusted" and 
  stringcontains~(event0.process.command_line, dll.name)]

Field Validations

Loading…

Comments (0)

Loading comments...