Elastic Defend high stable eql

Potential Injection via Asynchronous Procedure Call

Identifies attempts to queue an Asynchronous Procedure Call (APC) to a remote process. This may indicate a remote code injection attack.

View Source

Detection Logic

api where process.pid != 4 and process.Ext.api.behaviors == "cross-process" and
 (
  (process.Ext.api.name == "QueueUserAPC" and process.Ext.api.behaviors == "execute_shellcode" and process.Ext.api.summary like "*Unbacked*NULL*") or
  (process.Ext.api.name == "NtQueueApcThread" and process.Ext.api.summary like "*ntdll.dll!RtlEncodeRemotePointer*")
  )

Field Validations

Loading…

Comments (0)

Loading comments...