Elastic Defend high stable eql

Module Stomping from a Copied Library

Identifies the load of a library that was recently copied and with a unusual memory allocation properties. This may be the result of a code injection using module stomping or DLL hollowing via overwriting the content of legit DLL with malicious code.

View Source

Detection Logic

sequence by user.id with maxspan=3m

[file where event.action != "deletion" and
 not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and

  /* PE file dropped via CopyFile API calls  */
  file.Ext.header_bytes : "4d5a*" and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: ("*CopyFileEx*", "*MoveFileExW*")) and

 not process.executable : ("?:\\Program Files (x86)\\Citrix\\ICA Client\\concentr.exe",  
                           "?:\\Program Files (x86)\\InstallShield Installation Information\\*\\setup.exe") and
 not file.path : ("?:\\Program Files (x86)\\Web Components\\NetStream.dll", "C:\\WINDOWS\\system32\\myah0.cpl")] as event0

[library where

  /* common networing and recon system modules */
  dll.name : ("ws2_32.dll", "dnsapi.dll", "wininet.dll", "psapi.dll", "vaultcli.dll") and

  /* stack starts from the recently dropped PE */
  endswith~(process.thread.Ext.call_stack_summary, event0.file.name) and

  /* Process name is different from the dropped PE */
  process.name != event0.file.name and

  /* Abnormal private bytes allocation for the dropped PE when loaded in memory */
 _arraysearch(process.thread.Ext.call_stack, $entry,
              $entry.allocation_private_bytes >= 100000 and startswith~($entry.symbol_info, event0.file.path))]

Field Validations

Loading…

Comments (0)

Loading comments...