Elastic Defend high stable eql

Potential Evasion via Stack Rumbling

Identifies modification of the Image File Execution Options registry value MinimumStackCommitInBytes. Adversaries may abuse this key to force the crash of an endpoint security solution due to stack overflow.

View Source

Detection Logic

registry where registry.data.strings != null and
 registry.path : ("HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\*\\MinimumStackCommitInBytes",
                  "HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\*\\MinimumStackCommitInBytes")

Field Validations

Loading…

Comments (0)

Loading comments...