Elastic Defend high stable eql

Potential DLL Search Order Hijacking of an Existing Program

Identifies attempts to load a recently created unsigned DLL file by an already existing signed process. This may indicate an attempt to load a malicious module via DLL search order hijacking.

View Source

Detection Logic

sequence by process.entity_id with maxspan=1m

   [process where event.action == "start" and
    process.code_signature.trusted == true and
    process.executable : ("?:\\ProgramData\\*.exe", "?:\\Users\\*.exe") and

    /* creation time is at least 30 days old */
    process.Ext.relative_file_creation_time >= 2592000 and

    /* not modified in the last 24 hours */
    process.Ext.relative_file_name_modify_time > 86400 and

    not process.code_signature.subject_name :
              ("IFS World Operations AB", "TEAMDEV LTD.", "philandro Software GmbH", "Autodesk, Inc.", "Loom, Inc.",
               "SystemServer", "Kramer Electronics LTD.", "WILLIAM HENSHAW (Affiliate)", "Oracle America, Inc.",
               "Voicebrook Inc")
    ]

   [library where
    /* creation time equal or less than 24 hrs*/
    dll.Ext.relative_file_creation_time <= 86400 and
    not dll.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and
    process.executable : ("?:\\ProgramData\\*.exe", "?:\\Users\\*.exe") and
    dll.path : ("?:\\ProgramData\\*.dll", "?:\\Users\\*.dll") and

    /* DLL loaded from the process.executable current directory */
	 endswith~(substring(dll.path, 0, length(dll.path) - (length(dll.name) + 1)), substring(process.executable, 0, length(process.executable) - (length(process.name) + 1))) and

	 not dll.hash.sha256 :
	         ("73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf",
	          "76f19b52423774932831dcba0596989ec56213f9b217a0432fbc122f99704a2a",
	          "0da7803bdd72de8f635336057d3d672b645d4da963e5c61544a4c5a2e8289fd8",
	          "d78adc29ea8fd4f180a3eaaa5713874af42cb79509aef6509af299b895b8dd77",
	          "822dae5c53e148cad6a789fb5f6fb759fab740e2d34d07f3ddbed5cbe226a785",
	          "3871034ebb72b5700722526ce15a67030a9d42ec9329dd878d979ed680dc9424",
	          "8740c64aaeba10108c4384eb6723407b8e9bed4f57c79c0f279ab9f28cb6287e",
	          "db00672e1b66559684e66c4c92aa39230ee75234a2580b0730c39dc171db632a")]

Field Validations

Loading…

Comments (0)

Loading comments...