Elastic Defend high stable eql

Potential Execution via Shortcut Modification

Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.

View Source

Detection Logic

process where event.action : "start" and

 process.name : ("cmd.exe", "powershell.exe") and process.parent.executable : "?:\\Windows\\Explorer.exe" and

 process.working_directory :
       ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "?:\\Users\\*\\AppData\\Roaming\\Zoom\\bin\\*",
        "?:\\Users\\*\\AppData\\Local\\slack\\*", "?:\\Users\\*\\AppData\\Local\\Discord\\*") and

 process.command_line : ("*chrome.exe*", "*firefox.exe*", "*outlook.exe*", "msedge.exe", "*thunderbird.exe*",
                         "*slack.exe*", "*notepad++.exe*", "*discord.exe*", "*winword.exe*", "*excel.exe*", "*powerpnt*",
                         "*Teams*", "*zoom.exe*", "*update.exe*") and 
 not (process.name : "cmd.exe" and process.command_line : "*chrome.exe*" and process.args : "SET RENDERDOC_HOOK_EGL=0 && START \"")

Field Validations

Loading…

Comments (0)

Loading comments...