Elastic Defend high stable eql

Reflective Dylib Load

Detects the potential loading of a dylib from memory by looking for dylib load events without a dll.path present indicating the dylib was not loaded from disk. Loading a dylib directly into memory is a technique often used by attackers to evade detection. This is because loading a dylib directly into memory leaves no traces on the disk, making it harder for security tools or analysts to detect the malicious dylib.

View Source

Detection Logic

library where ((event.action == "load" and not dll.path : "?*") or 
 (event.action == "load" and dll.name like "NSCreateObjectFileImageFromMemory*")) and 
 process.name != null and
 process.executable != null and
 ((process.code_signature.trusted == false or process.code_signature.exists == false) or
  process.name like~ ("osascript", "bash", "sh", "zsh", "node")) and
 not process.code_signature.signing_id like "com.steinberg.cubase*" and
 not process.executable like "/private/tmp/PKInstallSandbox.*" and
 not Effective_process.executable like ("/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
                                        "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService",
                                        "/Library/Kandji/Kandji Agent.app/Contents/Helpers/Kandji Library Manager.app/Contents/MacOS/kandji-library-manager",
                                        "/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon", 
                                        "/Applications/iZotope Product Portal.app/Contents/MacOS/Product Portal")

Field Validations

Loading…

Comments (0)

Loading comments...