Elastic Defend high stable eql

DLL Side Loading of a file dropped by Microsoft Office

Identifies when a Microsoft Office process creates an executable file (DLL) and the file is subsequently loaded by a trusted binary. An adversary may deliver a weaponized Office document to their target that writes and loads malicious modules.

View Source

Detection Logic

sequence with maxspan=5m
  [ file where event.action != "deletion" and
      process.name :
          ("WINWORD.EXE",
           "EXCEL.EXE",
           "POWERPNT.EXE",
           "MSACCESS.EXE",
           "MSPUB.EXE") and
      (
        file.extension : ("dll", "cpl", "ocx") or
        // Match Windows PE files by header data (MZ)
        file.Ext.header_bytes : "4d5a*"
      ) ] by file.path
  [ library where
   (dll.code_signature.exists == false or
   (dll.code_signature.trusted == false and not dll.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*"))) and
    process.code_signature.trusted == true and
    not process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE", "ONENOTE.EXE") and
    not startswith~(dll.name, process.name) and
    not dll.hash.sha256 in ("ac0b2e4ea19c34536a58e6818fe0d37599495a6b3da7e8d3a3444ea0eff9d6e6", "d85639d208dc27961832b15eb42f9861faffca18e0ded8d5697c9bf13b7b598c") and
    not dll.path : "?:\\Windows\\assembly\\NativeImages_*" and
    not (process.executable : "?:\\Windows\\System32\\spoolsv.exe" and user.id : "S-1-5-18") and
    not process.executable : ("?:\\Windows\\SysWOW64\\msiexec.exe", "?:\\Windows\\system32\\msiexec.exe")
    ] by dll.path

Field Validations

Loading…

Comments (0)

Loading comments...