Elastic Defend high stable eql

Driver Dropped by Untrusted Executable

Identifies the creation of a driver file by an untrusted program and subsequently loaded in the kernel. Adversaries may bring a driver onto a compromised machine to execute code with the highest privileges.

View Source

Detection Logic

sequence with maxspan=5m 
 [process where event.action == "start" and 
  (process.code_signature.trusted == false or process.code_signature.exists == false) and 
  (process.Ext.relative_file_creation_time <= 3600 or process.Ext.relative_file_name_modify_time <= 500) and
  process.hash.sha256 != "bb3468b6c88b0553d039ec3c4e6a13aa9ce500d6962ca906dfda57b7deafcfa9"] as event0
 [file where event.action != "deletion" and
  (file.extension : "sys" or file.Ext.header_bytes : "4d5a*") and 
   process.entity_id == event0.process.entity_id and 
  (process.code_signature.trusted == false or process.code_signature.exists == false)] as event1
 [library where process.pid == 4 and 
  startswith~(dll.path, event1.file.path) and 
  not (dll.code_signature.subject_name : ("FinalWire Kft.", "Musaruba US LLC") and dll.code_signature.trusted == true)]

Field Validations

Loading…

Comments (0)

Loading comments...