Elastic Defend high stable eql

Potential Browser Exploit via Fake RPC Messages

Identifies attempt to call memory manipulation APIs or load a library where call stack is pointing to the RPC function NdrServerCall, this may indicate an attempt to exploit a vulnerability using fake RPC messages to bypass CFG mitigation. A known example of vulnerability using this primitive is CVE-2021-26411.

View Source

Detection Logic

any where event.category in ("api", "library") and
 process.name in~ ("chrome.exe", "msedge.exe", "iexplore.exe", "brave.exe", "whale.exe", "browser.exe", "dragon.exe", "vivaldi.exe",
                 "opera.exe", "seamonkey.exe", "safari.exe", "waterfox.exe") and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "*NdrServerCall2*") and 
 not process.Ext.api.summary :  ("VirtualProtect( koaxoj_?.dll,*)", "WriteProcessMemory( onedrive*") and 
 not dll.code_signature.trusted == true and 
 not dll.path : ("?:\\Windows\\System32\\jscript9.dll",
                 "?:\\Windows\\System32\\vaultcli.dll",
                 "?:\\Windows\\SysWOW64\\jscript9.dll",
                 "?:\\Windows\\SysWOW64\\vaultcli.dll",
                 "?:\\Windows\\System32\\wbem\\fastprox.dll") and
 not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: ("?:\\windows\\system32\\rpcrt4.dll!RpcBindingFromStringBindingW*", "c:\\windows\\system32\\rpcrt4.dll!I_RpcExceptionFilter+*"))

Field Validations

Loading…

Comments (0)

Loading comments...