Elastic Defend high stable eql

Potential Injection via the Console Window Class

Identifies the execution of a process from the Windows Console host and from an unbacked memeory region. This may indicate an attempt to inject code via the ConsoleWindowClass method.

View Source

Detection Logic

process where event.action == "start" and
 process.parent.name : "conhost.exe" and
 process.parent.thread.Ext.call_stack_contains_unbacked == true and
 process.parent.thread.Ext.call_stack_summary : "*kernelbase.dll
| Unbacked*" and
 not process.executable : "C:\\Program Files (x86)\\Microsoft Intune Management Extension\\AgentExecutor.exe"

Field Validations

Loading…

Comments (0)

Loading comments...