Elastic Defend high stable eql

Potential DLL Hollowing from a Writable Image

Identifies attempts to stealthily execute malicious code using DLL hollowing technique from a writable image.

View Source

Detection Logic

library where
  dll.Ext.defense_evasions : "Process Tampering: Image is writable" and
  dll.Ext.defense_evasions : "Process Tampering: Image has write sharing" and
  dll.Ext.defense_evasions : "Process Tampering: Image has been accessed before mapping"

Field Validations

Loading…

Comments (0)

Loading comments...