Elastic Defend high stable eql

Parallel NTDLL Loaded from Unbacked Memory

Identifies the load of NTDLL for the second time and from an unbacked call stack. This may indicate the use of direct system calls to evade endpoint security solutions hooking Windows APIs.

View Source

Detection Logic

library where dll.name : "ntdll.dll" and
 dll.Ext.load_index >= 2 and
 process.thread.Ext.call_stack_summary :
                   ("*kernelbase.dll
| Unbacked*",
                    "Unbacked*",
                    "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| Unbacked",
                    "ntdll.dll
| Unbacked",
                    "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| Unbacked
| kernel32.dll
| ntdll.dll",
                    "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| Unbacked
| clr.dll
| mscorlib.ni.dll
| Unbacked
| clr.dll
| mscorlib.ni.dll
| Unbacked
| clr.dll
| mscoreei.dll
| mscoree.dll
| ntdll.dll") and
 not (process.code_signature.subject_name == "Check Point Software Technologies Ltd." and
      process.code_signature.trusted == true and process.thread.Ext.call_stack_summary : "ntdll.dll
| Unbacked") and
 not (process.executable : "?:\\Windows\\System32\\taskhostw.exe" and user.id : "S-1-5-18" and
      process.thread.Ext.call_stack_summary : "Unbacked") and
 not process.executable : "C:\\Program Files (x86)\\Steam\\steamapps\\common\\MonsterHunterWilds\\MonsterHunterWilds.exe"

Field Validations

Loading…

Comments (0)

Loading comments...