Elastic Defend high stable eql

Lateral Execution via DCOM Office Application

Identifies remote execution via Distributed Component Object Model service to launch a process via a Microsoft Office application.

View Source

Detection Logic

process where event.action == "start" and process.Ext.session_info.logon_type : "Network*" and
 process.parent.executable : "?:\\Program Files*\\Microsoft Office\\*.exe" and process.parent.args : "-Embedding" and 
 not process.executable : ("C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe", 
                           "C:\\Program Files\\Microsoft Office\\root\\Client\\AppVDllSurrogate64.exe",
                           "C:\\Program Files (x86)\\Microsoft Office\\root\\Client\\AppVDllSurrogate64.exe")

Field Validations

Loading…

Comments (0)

Loading comments...