Elastic Defend high stable eql

Potential Protected Process DLL Injection via RPC

Identifies when a process running as protected process loads an unsigned DLL. This may indicate an attempt to bypass Process Protection and inject malicious code.

View Source

Detection Logic

library where dll.Ext.defense_evasions : "Process Tampering: Code integrity violation" and
  process.thread.Ext.call_stack_summary : "ntdll.dll
| rpcrt4.dll
| combase.dll
| *"

Field Validations

Loading…

Comments (0)

Loading comments...