Elastic Defend high stable eql

Indirect Command Execution via ForFiles

Identifies the use of native Windows tool, forfiles to execute a file. Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

View Source

Detection Logic

process where event.action == "start" and
  process.parent.name : "forfiles.exe" and process.parent.args : "/c" and
  process.parent.args : "/p" and process.parent.args : "/m" and

  not process.executable : "?:\\Windows\\System32\\conhost.exe" and
  not user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
  not (process.name : "cmd.exe" and process.args: ("del", "xcopy", "cmd /c del @PATH", "move")) and
  not (process.name : "cmd.exe" and process.command_line :  "/c if TRUE==TRUE rmdir /s /q \"nw*\"") and
  not (process.name : "cmd.exe" and process.command_line : "*echo *J2A* Autolog*") and
  not (process.name : "cmd.exe" and process.args : "echo" and length(process.command_line) <= 25) and
  process.working_directory : ("?:\\", "?:\\*\\AppData\\*", "?:\\Windows\\*") and
  not (process.name : "cmd.exe" and process.command_line : "*Datei*TempAttachments*") and
  not (process.name : "cmd.exe" and process.args : "?:\\Program Files\\CZM\\Tools\\FileCommit.bat") and
  not process.parent.args : "cmd /c echo @PATH"

Field Validations

Loading…

Comments (0)

Loading comments...