Elastic Defend high stable eql

Execution via Internet Explorer Exporter

Identifies the execution of the built-in Windows program, ExtExport, which can be used for execution via side-loading a malicious DLL with one of the following names: mozcrt19.dll, mozsqlite3.dll, or sqlite.dll.

View Source

Detection Logic

sequence by user.id with maxspan=5m
 [file where event.action != "deletion" and
  file.name : ("sqlite3.dll", "mozcrt19.dll", "mozsqlite3.dll") and
  not file.path : ("?:\\Program Files (x86)\\*.dll", "?:\\Program Files\\*.dll")]
 [process where event.action == "start" and process.pe.original_file_name : "extexport.exe" and
  not process.executable : ("?:\\Program Files (x86)\\Internet Explorer\\ExtExport.exe",
                            "?:\\Program Files\\Internet Explorer\\ExtExport.exe")]

Field Validations

Loading…

Comments (0)

Loading comments...