Elastic Defend high stable eql

Execution via DCOM Excel Application

Identifies suspicious execution via Distributed Component Object Model service to launch an application via Excel.

View Source

Detection Logic

process where event.action == "start" and 
 process.parent.name : "excel.exe" and process.parent.args : "-Embedding" and 
 process.name : ("FOXPROW.exe", "SCHDPLUS.exe", "WINPROJ.exe")

Field Validations

Loading…

Comments (0)

Loading comments...