Elastic Defend high stable eql

Execution of a DNGUard Protected Program

Identifies when a program is loading DNGUard DLL (DNGuard HVM is a .NET obfuscator and code protector), this may indicate an attempt to bypass static detection by obfuscating malicious code.

View Source

Detection Logic

sequence by process.entity_id with maxspan=1m
 [process where event.action == "start" and
  (process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500) and
  not process.executable : "?:\\Program Files (x86)\\Digiarty\\WinX MediaTrans\\MediaTrans.exe"]
  [library where
   (dll.name :"HVMRuntm.dll" or
    dll.hash.sha256 :"a0b11444c5913bc048c2f97b670cc801176df17565c48d6e7a30fef651ca8426" or
    dll.pe.imphash : "b2ff0f091ba14e9fe411060ab1560c66")]

Field Validations

Loading…

Comments (0)

Loading comments...