Elastic Defend high stable eql

Potential Privilege Escalation via Missing DLL

Identifies the loading of a non Microsoft signed DLL that is missing on a default Windows installation (phantom DLL) or one that can be loaded from a different location by a native Windows process. This may be abused to persist or elevate privileges via privileged file write vulnerabilities.

View Source

Detection Logic

library where
   user.id : "S-1-5-18" and (dll.code_signature.trusted == false or dll.code_signature.exists == false) and 
   (dll.Ext.relative_file_creation_time <= 172800 or dll.Ext.relative_file_name_modify_time <= 172800) and 
     (
       dll.name :
         ("wlbsctrl.dll",
          "WptsExtensions.dll",
          "Tsmsisrv.dll",
          "TSVIPSrv.dll",
          "Msfte.dll",
          "wow64log.dll",
          "WindowsCoreDeviceInfo.dll",
          "phoneinfo.dll",
          "EdgeGdi.dll",
          "cdpsgshims.dll",
          "diagtrack_win.dll",
          "wlanhlp.dll",
          "healthapi.dll",
          "prntvpt.dll",
          "SprintCSP.dll") or
       dll.path : ("?:\\Windows\\System32\\Ualapi.dll",
                   "?:\\Windows\\SysWOW64\\Ualapi.dll",
                   "?:\\Windows\\System\\Ualapi.dll",
                   "?:\\Windows\\Ualapi.dll",
                   "?:\\Windows\\System32\\oci.dll",
                   "?:\\Windows\\System32\\spool\\drivers\\x64\\PrintConfig.dll",
                   "?:\\windows\\Ualapi.dll",
                   "?:\\windows\\wbemcomn.dll",
                   "?:\\Windows\\oci.dll",
                   "?:\\windows\\System32\\Wbem\\Ualapi.dll",
                   "?:\\windows\\System32\\WindowsPowerShell\\v1.0\\wbemcomn.dll",
                   "?:\\windows\\System32\\WindowsPowerShell\\v1.0\\Ualapi.dll",
                   "?:\\windows\\System32\\WindowsPowerShell\\v1.0\\oci.dll",
                   "?:\\Python??\\wbemcomn.dll",
                   "?:\\Python??\\Ualapi.dll",
                   "?:\\Python??\\oci.dll",
                   "?:\\windows\\System32\\OpenSSH\\wbemcomn.dll",
                   "?:\\windows\\System32\\OpenSSH\\oci.dll",
                   "?:\\windows\\System32\\OpenSSH\\Ualapi.dll", 
                   "?:\\Windows\\System32\\wbem\\wbemcomn.dll", 
                   "?:\\Windows\\SysWOW64\\wbem\\wbemcomn.dll")
     ) and
     not dll.path : 
               ("?:\\Windows\\System32\\prntvpt.dll", 
                "?:\\Windows\\System32\\wlanhlp.dll", 
                "?:\\Windows\\SysWOW64\\prntvpt.dll", 
                "?:\\Windows\\WinSxS\\*.dll") and 
     not (dll.pe.imphash : "a9ab204cf2b4a1903b3fba3c920bd357" and dll.name : "Ualapi.dll")

Field Validations

Loading…

Comments (0)

Loading comments...