Elastic Defend high stable eql

Potential Self Deletion of a Running Executable

Identifies the execution of a file followed by the rename of its primary file stream. This may indicate an attempt to delete the currently running process executable file on disk, bypassing the file lock restriction. Adversaries may delete files left behind by the actions of their intrusion activity.

View Source

Detection Logic

sequence by process.entity_id with maxspan=1m
    [library where not dll.code_signature.status : "trusted" and
      not (process.code_signature.subject_name: ("Datto Inc", "Elasticsearch, Inc.") and process.code_signature.trusted == true)] by dll.name
    [file where event.action == "rename" and
     /* Rename the primary file stream */
     file.name : "*:*" and not file.Ext.original.name : "*:*"  and file.size == 0] by file.Ext.original.name

Field Validations

Loading…

Comments (0)

Loading comments...