Elastic Defend high stable eql

Execution via Microsoft Excel XLL Add-In

Identifies attempt to execute and load an unsigned Microsoft Excel XLL Addin. This may indicate an attempt to get initial access via a malicious phishing Microsoft Office Excel Add-In.

View Source

Detection Logic

sequence by process.entity_id with maxspan=2m
 [process where event.action == "start" and
  process.name : "EXCEL.EXE" and process.args : "-xlls"]
 [library where
  process.name : "EXCEL.EXE" and dll.name : "*.xll" and
  not dll.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*")]

Field Validations

Loading…

Comments (0)

Loading comments...