Elastic Defend high stable eql

Image Hollow from Unusual Stack

Identifies attempt to modify the content of a loaded module and from a suspicious call stack. This may indicate an attempt to inject code using module stomping or DLL hollowing via overwriting the content of a legit DLL with malicious code.

View Source

Detection Logic

api where process.Ext.api.behaviors == "hollow_image" and
  process.Ext.api.name == "VirtualProtect" and
  process.Ext.api.parameters.size >= 10000 and process.executable != null and
  process.thread.Ext.call_stack_summary in
                     ("ntdll.dll
| kernelbase.dll
| Unbacked",
                      "ntdll.dll
| kernelbase.dll
| kernel32.dll
| Unbacked",
                      "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| Unbacked",
                      "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| Unbacked
| kernel32.dll
| ntdll.dll") and
  process.Ext.api.metadata.target_address_path like "c:\\windows\\sys?????\\*.dll" and
  process.thread.Ext.call_stack_final_user_module.hash.sha256 != null and
  not _arraysearch(process.thread.Ext.call_stack, $entry, 
                   $entry.protection_provenance like ("Kernel*", "tcaddin.dll", "clr.dll", "appvisvsubsystems64.dll", 
                                                  "appvisvsubsystems.dll", "softmon.exe
| *", "appventsubsystems32.dll", 
                                                  "appventsubsystems64.dll", "appventsubsystems.dll")) and
  not (process.Ext.api.summary : ("*qipcap64.dll*", "*redemption64*", "*eowp.22.1.94.0.exe*", "*conemuhk64.dll*", "*xalan-c_1_10.dll*", "* av.dll*",
                                 "*crpe32.dll*", "*_*.dll*", "*-*.dll*", "*sqlite?.dll*", "*appprofiler.x64.dll*", "*appprofiler.x86.dll*", "*qmgr.dll*", "*cxll*.llx*", "*.exe*") and
                                  not process.Ext.api.summary : "*ws2_32*") and
  not (process.parent.executable : "?:\\Program Files (x86)\\think-cell\\tcasr.exe" and 
       process.executable : "?:\\Program Files\\Microsoft Office\\root\\Office*\\EXCEL.EXE") and
  not (process.code_signature.subject_name : ("Code Systems Corporation", "Essential Objects, Inc.", "JAM Software GmbH",
                                              "IMSI Design, LLC", "Nuance Communications, Inc.", "Rocket Software, Inc.", 
                                              "Tracker Software Products (Canada) Ltd", "Sage Software, Inc.", "Azul Systems, Inc.",
                                              "Essential Objects, Inc.") and
       process.code_signature.trusted == true) and
  not (process.parent.executable : ("?:\\Program Files (x86)\\Google\\Update\\GoogleUpdate.exe", "?:\\Program Files\\Google\\Update\\GoogleUpdate.exe") and
       process.executable : ("?:\\Program Files (x86)\\Google\\Update\\*\\GoogleCrashHandler*.exe", "?:\\Program Files\\Google\\Update\\*\\GoogleCrashHandler*.exe")) and
  not process.executable :
               ("?:\\Program Files\\*.exe",
                "?:\\Program Files (x86)\\*.exe",
                "?:\\Windows\\System32\\inetsrv\\w3wp.exe", 
                "?:\\Windows\\SysWOW64\\inetsrv\\w3wp.exe", 
                "?:\\Windows\\SystemApps\\*.exe", 
                "?:\\Windows\\System32\\taskhostw.exe") and
  not (process.executable : "?:\\Windows\\Sys*\\msiexec.exe" and process.Ext.api.summary : "*msi*.tmp*") and
  not (process.executable : "?:\\Windows\\Sys*\\rundll32.exe" and process.command_line : ("*--no-sandbox*", "*--eoim*")) and
  not (process.executable : "?:\\Windows\\System32\\backgroundTaskHost.exe" and
       process.parent.executable : "?:\\Windows\\System32\\svchost.exe") and
  not process.parent.executable : ("?:\\Program Files (x86)\\Steam\\steam.exe", "?:\\Program Files\\Steam\\steam.exe") and
  not (process.Ext.api.metadata.target_address_name : "cxll27*.llx" and process.parent.executable : "C:\\Program Files (x86)\\Citrix\\HDX\\bin\\WfShell.exe") and
  not (process.Ext.api.metadata.target_address_name == "libcapki.dll" and process.parent.executable : "C:\\Program Files (x86)\\CA\\DSM\\Bin\\*.exe") and
  not process.thread.Ext.call_stack_final_user_module.hash.sha256 in ("2ef1f7e839e332d97e32ee0213c92d0e74536fb3af04b6df1d335e2f101f968e",
   "a20a14118c2f06a1cc502095a1f18b3cb34ad75f1684f7ec26e24a68d4e3114c", "da502d1a77883ab56d110889237ce7f18527a1d78e85078f40d269966059e267",
   "2a2f9dc5f88e4596ade6a57ec2baa8586dbade44e6df9ecb32035cfd1d8bd85d", "c7d833a8fdfac8a79f9f861af7f6f476bb7b36c71c5fa60e668728008b16a43e") and
  not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true)

Field Validations

Loading…

Comments (0)

Loading comments...