Elastic Defend high stable eql

Process from Archive or Removable Media via Unbacked Code

Identifies the creation of a process where the creating thread's stack contains frames pointing outside any known executable image and the parent process is executing from a mounted virtual disk, archive or USB device. This may be indicative of the creation of a process as a result of a code injection.

View Source

Detection Logic

sequence by user.id with maxspan=3m
 [process where event.action == "start" and not user.id : "S-1-5-18" and
  (
   (process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk", "USB *") and not process.executable : "C:\\*") or
   process.executable :
          ("?:\\Users\\*\\AppData\\Local\\Temp\\7z*\\*",
           "?:\\Users\\*\\AppData\\Local\\Temp\\Rar$*\\*",
           "?:\\Users\\*\\AppData\\Local\\Temp\\RarSFX*",
           "?:\\Users\\*\\AppData\\Local\\Temp\\Temp?_*\\*",
           "?:\\Users\\*\\AppData\\Local\\Temp\\BNZ.*") or
   (process.parent.name : "explorer.exe" and process.parent.thread.Ext.call_stack_summary : "*shlwapi.dll
| zipfldr.dll
| shell32.dll*")
   ) and
   not (process.code_signature.subject_name : "Carbon Black, Inc." and process.code_signature.trusted == true)
 ] by process.entity_id
 [process where event.action == "start" and
  process.parent.thread.Ext.call_stack_contains_unbacked == true and
  not process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk", "USB *") and
  process.parent.thread.Ext.call_stack_summary :
                           ("ntdll.dll
| kernelbase.dll
| kernel32.dll
| Unbacked",
                            "ntdll.dll
| kernelbase.dll
| Unbacked",
                            "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| Unbacked",
                            "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| windows.storage.dll
| shell32.dll
| Unbacked",
                            "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| Unbacked
| kernel32.dll
| ntdll.dll",
                            "*mscorlib.ni.dll
| microsoft.visualbasic.ni.dll
| Unbacked*",
                            "ntdll.dll
| kernelbase.dll
| kernel32.dll
| system.ni.dll
| clr.dll
| mscorlib.ni.dll
| Unbacked",
                            "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| kernel32.dll
| Unbacked
| kernel32.dll
| ntdll.dll") and
  not (process.code_signature.trusted == true and process.code_signature.subject_name in ("Reason Cybersecurity Inc.", "Environmental Systems Research Institute, Inc.", "Chaos Software GmbH")) and
  not process.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe")
  ] by process.parent.entity_id

Field Validations

Loading…

Comments (0)

Loading comments...