Elastic Defend high stable eql

Ingress Transfer via Windows Utility

Identifies attempt to download remote content by commonly abused ingress tool transfer binaries.

View Source

Detection Logic

process where event.action == "start" and
(
 ((process.name : "CertUtil.exe" or process.pe.original_file_name == "CertUtil.exe") and
  process.args : "-urlcache" and process.command_line : "*http*") or

 ((process.pe.original_file_name == "CertReq.exe" or process.name : "CertReq.exe") and
  process.args : "-Post" and process.command_line : "*http*")
 )

Field Validations

Loading…

Comments (0)

Loading comments...