Elastic Defend high stable eql

Potential AutoConfigURL Settings Hijack

Identifies registry modification to modify the system internet proxy settings by an unusual process. This may indicate an attempt to hijack user internet traffic to certain websites.

View Source

Detection Logic

registry where
 registry.path : "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL" and
 registry.data.strings : "*http*" and not registry.data.strings : "*127.0.0.1*" and process.executable != null and
 (
  process.code_signature.trusted == false or
  process.code_signature.exists == false or
  process.name : ("powershell.exe", "wscript.exe", "cscript.exe")
  ) and
  not process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "C:\\LexisNexis\\Shared\\RwEasyMAPI64.exe")

Field Validations

Loading…

Comments (0)

Loading comments...