Elastic Defend high stable eql

Potential Privilege Escalation via DLL Redirection

Identifies attempts to load a module by a SYSTEM process and via side by side DLL redirection. This may indicate an attempt to elevate privileges via DLL search order hijacking.

View Source

Detection Logic

library where user.id : "S-1-5-18" and
   dll.path : ("?:\\Windows\\system32\\*.exe.local\\*",
               "?:\\Windows\\syswow64\\*.exe.local\\*",
               "?:\\Program Files (x86)\\Microsoft\\*.exe.local\\*",
               "?:\\Program Files\\Microsoft\\*.exe.local\\*") and
  not (dll.code_signature.subject_name : "Microsoft *" and dll.code_signature.trusted == true) and
  process.executable :
               ("?:\\Windows\\system32\\*",
                "?:\\Windows\\syswow64\\*",
                "?:\\Program Files (x86)\\Microsoft\\*",
                "?:\\Program Files\\Microsoft\\*")

Field Validations

Loading…

Comments (0)

Loading comments...