Elastic Defend high stable eql

Powershell Execution via Runscripthelper

Detects attempts to execute a powershell script bypassing constrained language mode using the RunScriptHelper utility.

View Source

Detection Logic

process where event.action == "start" and 
 (process.name : "runscripthelper.exe" or process.pe.original_file_name : "runscripthelper.exe") and 
 process.args : "surfacecheck" and process.args_count > 3

Field Validations

Loading…

Comments (0)

Loading comments...