Elastic Defend high stable eql

Evasion via Device Credential Deployment

Identifies attempts to hide Windows Command Console Window. Adversaries may use DeviceCredentialDeployment to evade user suspicion.

View Source

Detection Logic

process where event.action == "start" and
 (
  (process.name : "cmd.exe" and process.command_line : "*DeviceCredentialDeployment*") or
  ((process.pe.original_file_name : "\"DeviceCredentialDeployment.exe\"" or process.name : "DeviceCredentialDeployment.exe") and
    process.parent.name : ("cmd.exe", "powershell.exe"))
 )

Field Validations

Loading…

Comments (0)

Loading comments...