Elastic Defend high stable eql

Potential Process Creation via ShellCode

Identifies the creation of a process where the creating thread's stack contains frames pointing outside any known executable image and using commonly used Windows APIs like WinExec. This is a common pattern for code injection using default offensive shellcode templates.

View Source

Detection Logic

process where event.action == "start" and

process.parent.thread.Ext.call_stack_contains_unbacked == true and

 (process.parent.thread.Ext.call_stack_summary : "*kernel32.dll
| Unbacked*" and
  _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info : "*kernel32.dll!WinExec*")) and

not (process.code_signature.trusted == true and
     process.code_signature.subject_name : ("GIGA-BYTE TECHNOLOGY CO., LTD.", "Intuit Inc", "Ramsauer und Stuermer Software GmbH",
     "Aptean, Inc.", "MICRO-STAR INTERNATIONAL CO., LTD.")) and

not (process.executable : "C:\\Windows\\System32\\sc.exe" and process.parent.executable : "C:\\Windows\\System32\\svchost.exe" and
     process.command_line : "sc start LenovoPcManagerService") and
not process.executable :
                ("C:\\Program Files (x86)\\Ponds33\\Refined Method\\Main.exe",
                 "C:\\Program Files (x86)\\Ponds33\\Underdrain\\UDMain.exe",
                 "C:\\Program Files (x86)\\Ponds33\\NPCalc\\NPCalcMain.exe")

Field Validations

Loading…

Comments (0)

Loading comments...