Elastic Defend high stable eql

DLL Loaded from WebDav Share

Identifies the load of a library from a WebDav Share. Adversaries may abuse this method to evade dropping malicious files to victim file system.

View Source

Detection Logic

library where dll.path : "\\Device\\Mup\\*\\DavWWWRoot\\*" and 
 process.executable != null and not startswith~(dll.name, process.name) and 
 not process.executable : "\\Device\\Mup\\*\\DavWWWRoot\\*" and 
 not dll.path : "\\Device\\Mup\\*.sharepoint.com@SSL\\DavWWWRoot\\*"

Field Validations

Loading…

Comments (0)

Loading comments...