Elastic Defend high stable eql

Process Stared via Remote Thread

Identifies the creation of a process with parent call stack not pointing to normal process creation APIs. This may indicate process creation as a result of code injection.

View Source

Detection Logic

process where event.action == "start" and
 _arraysearch(process.parent.thread.Ext.call_stack, $entry,
              $entry.symbol_info: ("?:\\Windows\\System32\\ntdll.dll!ZwCreateThreadEx*",
                                   "?:\\Windows\\System32\\ntdll.dll!NtCreateThreadEx*")) and
 not _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info: ("*CreateProcess*", "*CreateUserProcess*"))

Field Validations

Loading…

Comments (0)

Loading comments...