Elastic Defend high stable eql

DLL Loaded from a Macro Enabled Document

Identifies when a Microsoft Office process loads a DLL and from a call stack pointing to Microsoft Office Visual Basic for Applications modules. This may indicate an attempt to get initial access using malicious macro enabled documents.

View Source

Detection Logic

library where
   process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "mspub.exe", "fltldr.exe", "visio.exe") and
   (
    /* VBA */
    process.thread.Ext.call_stack_summary : "*
| vbe?.dll*" or

    /* Shellcode RWX  */
    (_arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "Unbacked*" and $entry.protection : "RWX") and
     not process.thread.Ext.call_stack_summary : ("*
| clr.dll
| *", "*mscorwks.dll*", "*mscoreei.dll
| mscoree.dll*", "*system.management.ni.dll*"))
   ) and

   /* Suspicious DLLs */
   (
    dll.name : "taskschd.dll" or
    dll.Ext.relative_file_creation_time <= 300 or
    ((dll.code_signature.trusted == false or dll.code_signature.exists == false) and not dll.path : ("?:\\Windows\\System32\\*", "?:\\Windows\\SysWOW64\\*"))
    ) and

    not dll.path :
           ("?:\\Windows\\assembly\\NativeImages_*.dll",
            "?:\\Windows\\System32\\spool\\drivers\\x64\\3\\*",
            "?:\\Program Files\\*",
            "?:\\Program Files (x86)\\*",
            "?:\\Windows\\Microsoft.NET\\Framework*", 
            "?:\\Windows\\system32\\scrrun.dll",
            "?:\\Windows\\syswow64\\scrrun.dll",
            "?:\\Windows\\SysWOW64\\THREED32.OCX",
            "C:\\blp\\*",
            "?:\\Windows\\System32\\DriverStore\\FileRepository\\*") and
    not dll.hash.sha256 :
                 ("a33c6d203ffa6941b1e498f52f6ef565c5d731c2deecbae067c0039208a8db25",
                  "4579447a18f557ef95cad8df77634370dbe7ddeaed8d319ea6e7a26ac1e79db6",
                  "f1c4e834f96abc5d787bd3d4efea008537eb44fd3e3b6560f8cef4eace525a62",
                  "902553c9ffdc9e9751c6045b50590613183d4a7cc730365f7d629729a43fedcd",
                  "b80eca5b58d276be4d66bda65599e609efde2811de252172eeccea803826d41f",
                  "a33c6d203ffa6941b1e498f52f6ef565c5d731c2deecbae067c0039208a8db25",
                  "f110d49ca78d0fe8ee0fa1824f7bb714359159e824a65a13f2fd5bb7d91b692a",
                  "90b3278ba2df87e4d61817adacf60f467359e0ff54dc793c0d5fdbc5fb087e59",
                  "2e531fdebdc3468c03922545ce169804400e3ebb577e08ec88a6561901d2c595",
                  "97c8afd6038b37729933ea0895760abe0a15b48258c46a04a0d010ed1ffa4e07",
                  "81fc25734e3876b34e287a1df17cb94483029534392fed50f0c629e40485660c",
                  "bd92610dd9504c6eef269b4c7b1bcaf9ebf28081bb81a82fc053035701182383",
                  "1e38e061ee5fcd4a76c591c24a39da005dc5fd58062ef8fadfe1ade95bfdbd4c",
                  "96c0caf8a7e7c087028c0793eb9a0ab21f7a4a7a5ca5c85a95ad1f4419a8186c",
                  "079cff190d73f4d1074844bf188588542cf3b52c22f775019fad113e0b63b14d",
                  "d661f1a025d99a98ebc6e42b3e69ae89379773821b2471ae138c4e55a5b63aa7",
                  "75e06078dd24506ffea81cf1615f5f9d9057abe2caf0067c396f20f3bea8b817",
                  "44185134b1f8c503c78e9dbc36891ba3fa109237c3dc79399955bf29e75921d4",
                  "9c2f359207114f5de82f080b08cbcfe723153b3f9c002c3f672a60e88c0d71b6")

Field Validations

Loading…

Comments (0)

Loading comments...