Elastic Defend high stable eql

Potential Exploit via Fake RPC Messages

Identifies attempt to call memory manipulation APIs or load a library where call stack is pointing to the RPC function NdrServerCall2, this may indicate an attempt to exploit a vulnerability using fake RPC messages to bypass CFG mitigation.

View Source

Detection Logic

any where event.category in ("api", "library") and
 process.thread.Ext.call_stack_summary like ("ntdll.dll
| rpcrt4.dll
| *", "ntdll.dll
| kernelbase.dll
| rpcrt4.dll
| *") and
  _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "*\\rpcrt4.dll!NdrServerCall2*") and
  not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: ("*\\rpcrt4.dll!Rpc*", "*\\rpcrt4.dll!I_Rpc*"))

Field Validations

Loading…

Comments (0)

Loading comments...