Elastic Defend high stable eql

Evasion via Event Tracing for Windows Patching

Identifies attempts to patch Microsoft Event Tracing for Windows via memory modification. This may indicate an attempt to disrupt detection of malicious activity by the Event Tracing facility for Windows.

View Source

Detection Logic

api where process.Ext.api.name :  "WriteProcessMemory*" and
 process.Ext.api.summary : ("*ntdll.dll!Etw*", "*ntdll.dll!NtTrace*") and
 process.executable != null and
 not process.executable : ("?:\\Windows\\System32\\lsass.exe",
                           "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
                           "?:\\Windows\\System32\\csrss.exe") and
 process.thread.Ext.call_stack_final_user_module.hash.sha256 != "7d678faf97ffbd27c01161ec6aaf9854226bef44ef70542e973aae004a85ea16" and
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and
                  $entry.subject_name in ("Microsoft Windows Hardware Compatibility Publisher",
                                          "Microsoft Windows Software Compatibility Publisher",
                                          "SentinelOne Inc."))

Field Validations

Loading…

Comments (0)

Loading comments...