Elastic Defend high stable eql

Potential Masquerading as Windows Error Manager

Identifies suspicious instances of the Windows Error Reporting process (WerFault.exe or Wermgr.exe) with matching a suspicious parent call stack. This may be indicative of a masquerading attempt to evade suspicious child process behavior detections.

View Source

Detection Logic

process where event.action == "start" and
 process.name : ("WerFault.exe", "wermgr.exe", "WerFaultSecure.exe") and
 process.parent.thread.Ext.call_stack_summary : "*
| *" and
 not process.parent.thread.Ext.call_stack_summary : ("*faultrep.dll*", "*wersvc.dll*", "*
| wer.dll
| *", "*
| ubpm.dll
| *", "*
| cbscore.dll
| rpcrt4.dll*") and
 not _arraysearch(process.parent.thread.Ext.call_stack, $entry,
                  $entry.symbol_info: ("*kernel32.dll*!Wer*",
                                       "*KernelBase.dll*!UnhandledExceptionFilter*",
                                       "*kernel32.dll*!BasepReportFault*",
                                       "*combase.dll!CoSetErrorInfo*",
                                       "?:\\Program Files\\*.dll*", 
                                       "?:\\Program Files (x86)\\*.dll*",
                                       "?:\\Windows\\System32\\dataclen.dll*Purge*",
                                       "?:\\Windows\\WinSxS\\Temp\\PendingDeletes\\*!WerpLaunchAeDebug*",
                                       "?:\\Windows\\System32\\tmumh\\*.dll*",
                                       "*kernel32.dll*!WerpLaunchAeDebug*",
                                       "?:\\Windows\\System32\\SettingsHandlers_StorageSense.dll!GetSettingForUser*",
                                       "?:\\Windows\\WinSxS\\Temp\\PendingDeletes\\*!UbpmTriggerConsumerQueryStatus*",
                                       "?:\\Windows\\System32\\SettingsHandlers_StorageSense.dll!DllGetActivationFactory*",
                                       "?:\\Windows\\System32\\dataclen.dll!DllCanUnloadNow+*", 
                                       "?:\\Windows\\System32\\CsXumd64_*.dll+*", 
                                       "*Acrobat.exe!IsSandboxedProcess*", 
                                       "*AcroRd32.exe!IsSandboxedProcess*", 
                                       "C:\\Temp\\tmmon64.dll+*", 
                                       "*\\PendingDeletes\\$$DeleteMe*", 
                                       "*ntdll.dll+0*", 
                                       "*KernelBase.dll+0x*",
                                       "*ntdll.dll!RtlCreateProcessReflection*", 
                                       "*ntdll.dll!RtlInitializeExceptionChain*", 
                                       "*dataclen.dll!?Purge*", 
                                       "*dataclen.dll!DllCanUnloadNow*", 
                                       "*shell32.dll!AssocCreateForClasses*")) and
 not process.parent.thread.Ext.call_stack_summary in
                                ("ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| wow64win.dll
| ntdll.dll",
                                 "ntdll.dll
| kernelbase.dll
| kernel32.dll
| Unknown
| ntdll.dll
| kernel32.dll
| ntdll.dll",
                                 "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| dtframe32.dll",
                                 "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| acrord32.exe
| ntdll.dll
| kernel32.dll
| ntdll.dll",
                                 "ntdll.dll
| kernelbase.dll
| kernel32.dll
| werfault.exe
| kernel32.dll
| ntdll.dll",
                                 "ntdll.dll
| kernelbase.dll
| Unknown
| ntdll.dll
| kernel32.dll
| ntdll.dll",
                                 "ntdll.dll
| kernelbase.dll
| hmpalert.dll
| kernelbase.dll
| kernel32.dll
| werfault.exe
| kernel32.dll
| ntdll.dll",
                                 "ntdll.dll
| kernelbase.dll
| kernel32.dll
| appxdeploymentserver.dll
| svchost.exe
| sechost.dll
| kernel32.dll
| ntdll.dll",
                                 "sysfer.dll
| kernelbase.dll
| kernel32.dll
| appxupgrademigrationplugin.dll
| kernel32.dll
| ntdll.dll",
                                 "ntdll.dll
| kernelbase.dll
| kernel32.dll
| appxdeploymentserver.dll
| ntdll.dll
| kernel32.dll
| ntdll.dll",
                                 "ntdll.dll
| kernelbase.dll
| kernel32.dll
| Unknown
| cbscore.dll
| wcp.dll
| ucrtbase.dll
| wcp.dll
| ntdll.dll
| wcp.dll
| cbscore.dll
| tiworker.exe
| rpcrt4.dll
| combase.dll
| rpcrt4.dll
| combase.dll
| rpcrt4.dll") and
 not _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.callsite_trailing_bytes : "488945???88b4d*") and
 /* Trellix */
 not _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.callsite_trailing_bytes : "488945*48894810488b4500ff50*")

Field Validations

Loading…

Comments (0)

Loading comments...