Elastic Defend high stable eql

Library Loaded from a Spoofed Call Stack

Detects library load from a potentially altered call stack in order to conceal the true source of the call.

View Source

Detection Logic

library where
  dll.name : ("wininet.dll", "ws2_32.dll", "winhttp.dll", "netapi32.dll", "wmiutils.dll", "wtsapi32.dll", "psapi.dll") and
  (
   process.thread.Ext.call_stack_summary == "ntdll.dll
| kernelbase.dll
| kernel32.dll
| ntdll.dll" or 
   
   (process.thread.Ext.call_stack_summary == "ntdll.dll
| kernel32.dll
| ntdll.dll" and 
    _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "*ntdll.dll!TpReleaseWait*") and
    _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "*ntdll.dll!RtlInitializeResource*") and 
    not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "*ntdll.dll!LdrUnloadDl*"))
   ) and
  _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "*\\ntdll.dll!LdrLoadDll*") and
  not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: ("*\\KernelBase.dll!LoadLibrary*", "*\\kernel32.dll!LoadLibrary*")) and
  not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: ("*\\KernelBase.dll+0x*", "*\\kernel32.dll+0x*"))

Field Validations

Loading…

Comments (0)

Loading comments...