Elastic Defend high stable eql

Potential Process Creation via Direct Syscall

Identifies the creation of a process with parent call stack not starting with Windows NT syscall DLLs such as ntdll and win32u. This may indicate the use of direct system calls to evade endpoint security solutions hooking Windows APIs.

View Source

Detection Logic

process where event.action == "start" and
 process.parent.thread.Ext.call_stack_summary : "Unbacked
| ?*" and
 not (process.parent.thread.Ext.call_stack_summary : "Unbacked
| embeddedbrowserwebview.dll
| Unbacked" and
      _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info : "?:\\Program Files*\\Microsoft\\EdgeWebView\\*\\EmbeddedBrowserWebView.dll*")) and 
 not (process.code_signature.subject_name in~ ("BYFRON TECHNOLOGIES LLC", "Valve Corp.", "Sony Interactive Entertainment LLC", "Roblox Corporation") and process.code_signature.trusted == true) and
 not process.parent.executable :  "?:\\Program Files\\WindowsApps\\ROBLOXCORPORATION.ROBLOX_*\\Windows10Universal.exe" and
 not (process.parent.code_signature.subject_name == "Roblox Corporation" and process.parent.code_signature.trusted == true) and
 not (process.code_signature.subject_name == "Roblox Corporation" and process.code_signature.trusted == true) and
 not (process.parent.thread.Ext.call_stack_summary like "Unbacked
| cymemdef64.dll
| *" and
       _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info like "C:\\Program Files\\Cylance\\Desktop\\CyMemDef64.dll*")) and
 not (process.executable : "C:\\ProgramData\\Sony Interactive Entertainment Inc\\PSPC_SDK\\*\\crashpad_handler.exe" and
      process.parent.thread.Ext.call_stack_summary == "Unbacked
| kernelbase.dll
| kernel32.dll
| gameoverlayrenderer64.dll
| Unbacked")

Field Validations

Loading…

Comments (0)

Loading comments...