Elastic Defend high stable eql

Potential CVE-2025-33053 Exploitation

Identifies a suspicious Diagnostics Utility for Internet Explorer child process. This may indicate the successful exploitation of the vulnerability CVE-2025-33053.

View Source

Detection Logic

process where event.action == "start" and
(
 (process.name : "iediagcmd.exe" and process.working_directory : "\\\\*") or
 (process.parent.executable : "C:\\Program Files\\Internet Explorer\\iediagcmd.exe" and
  process.name : ("route.exe", "netsh.exe", "ipconfig.exe", "dxdiag.exe", "conhost.exe", "makecab.exe") and
  process.executable != null and
  not process.executable : ("?:\\Windows\\System32\\route.exe",
                           "?:\\Windows\\System32\\netsh.exe",
                           "?:\\Windows\\System32\\ipconfig.exe",
                           "?:\\Windows\\System32\\dxdiag.exe",
                           "?:\\Windows\\System32\\conhost.exe",
                           "?:\\Windows\\System32\\makecab.exe"))
)

Field Validations

Loading…

Comments (0)

Loading comments...