Elastic Defend high stable eql

Microsoft Office Process Setting Persistence via Startup

Identifies files written to or modified in the startup folder by a Microsoft Office process. Adversaries may use this technique to maintain persistence and avoid spawning suspicious child processes.

View Source

Detection Logic

file where event.action != "deletion" and
  file.path : ("?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*",
               "?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\*") and
  process.name : ("EQNEDT32.EXE", "WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSPUB.EXE") and
  not file.extension : ("docx", "xls", "doc", "xlsx", "tmp", "xlsm") and file.name : "*.*"

Field Validations

Loading…

Comments (0)

Loading comments...