Elastic Defend high stable eql

Potential Lateral Movement via SMBExec

Identifies suspicious service execution via Windows Command Shell which may indicate lateral movement attempt via known offensive testing tool like SMBExec.

View Source

Detection Logic

process where event.action == "start" and
 (
   ((process.name : "cmd.exe" or process.pe.original_file_name == "Cmd.Exe") and process.parent.name : "services.exe" and
     process.command_line : "*/Q*echo*.bat*del*.bat*") or

   /* descendant of SMBExec */
   (descendant of
    [process where event.action == "start" and (process.name : "cmd.exe" or process.pe.original_file_name == "Cmd.Exe") and
     process.parent.name : "services.exe" and process.command_line : "*/Q*echo*.bat*del*.bat*"] and
     not process.executable : ("?:\\Windows\\system32\\cmd.exe", "?:\\Windows\\System32\\conhost.exe"))
  )

Field Validations

Loading…

Comments (0)

Loading comments...