Elastic Defend high stable eql

Potential Executable Stored in the Registry

Identifies registry write modifications to hide an encoded portable executable. This could be indicative of adversary defense evasion by avoiding the storing of malicious content directly on disk.

View Source

Detection Logic

registry where registry.data.strings : ("TVqQ*", "4d5a90000*") and not length(registry.data.strings) <= 100 and process.executable != null and
not (process.executable : "?:\\Program Files (x86)\\Schneider Electric\\Software Update\\SoftwareUpdate.exe" and registry.value : "FusTMP") and
not (process.executable : "C:\\Windows\\System32\\taskhostw.exe" and
     registry.path == "HKLM\\SYSTEM\\ControlSet001\\Services\\UCPD\\DR\\0000" and user.id == "S-1-5-18") and
not process.executable : "C:\\Program Files\\Tenable\\Nessus Agent\\nessusd.exe"

Field Validations

Loading…

Comments (0)

Loading comments...