Elastic Defend high stable eql

Dynwrapx Image Load via Windows Scripts

Identifies when a Windows script interpreter loads an external library that allow to call Windows API functions from scripts in JScript and VBScript. Malware may abuse this legit capability to interact further with the Operating System.

View Source

Detection Logic

sequence by process.entity_id with maxspan=1m
 [process where event.type == "start" and
  process.name : ("wscript.exe", "cscript.exe", "mshta.exe", "wmic.exe", "cmstp.exe", "msxsl.exe")]
 [library where dll.pe.original_file_name : "dynwrapx.dll"]

Field Validations

Loading…

Comments (0)

Loading comments...