Elastic Defend high stable eql

Persistence via AutodialDLL Registry Modification

Identifies the modification of the WinSock2 AutoDial registry value to potentially maintain persistence via a malicious DLL that get loaded by any processes invoking the Winsock 2 library (ws2_32.dll).

View Source

Detection Logic

registry where registry.data.strings != null and
    registry.path : "HKLM\\SYSTEM\\*ControlSet*\\Services\\WinSock2\\Parameters\\AutodialDLL*" and
    not registry.data.strings : "?:\\Windows\\System32\\rasadhlp.dll"

Field Validations

Loading…

Comments (0)

Loading comments...