Elastic Defend high stable eql

Evasion via LdrpKernel32 Overwrite

Identifies attempts to load a malicious DLL early via hijacking the normal NTDLL bootstrap process. Instead of loading kernel32 it will load a malicious one that may execute malicious code and resume the rest of the loading process steps.

View Source

Detection Logic

library where (dll.code_signature.trusted == false or dll.code_signature.exists == false) and process.uptime == 0 and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "*!BaseThreadInitThunk*") and 
 process.executable : ("?:\\*", "\\Device\\Mup\\*") and 
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                  $entry.symbol_info : ("?:\\Windows\\System32\\kernel32.dll!BaseThreadInitThunk*",
                                        "?:\\Windows\\SysWOW64\\kernel32.dll!BaseThreadInitThunk*",
                                        "?:\\Windows\\WinSxS\\*\\kernel32.dll!BaseThreadInitThunk*",
                                        "?:\\Windows\\WinSxS\\Temp\\PendingDeletes\\*!BaseThreadInitThunk*",
                                        "\\Device\\*\\Windows\\*\\kernel32.dll!BaseThreadInitThunk*")) and
 not dll.path : ("?:\\Windows\\assembly\\NativeImages_*\\System.Numerics.ni.dll", "C:\\Program Files\\Fortinet\\FortiClient\\utilsdll.dll")

Field Validations

Loading…

Comments (0)

Loading comments...