Elastic Defend high stable eql

Remote Process Injection via Mapping

Identifies attempts to map a view of a file or a page file-backed section with execute and write permissions into the address space of a remote process. This may indicate an attempt to inject code via memory mapping.

View Source

Detection Logic

api where process.Ext.api.name : "MapViewOfFile*" and
 not (process.code_signature.subject_name : "MPTronic" and process.code_signature.trusted == true) and
 process.Ext.api.behaviors : "cross-process" and process.Ext.api.parameters.protection : "RWX" and process.executable != null and
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and
                  $entry.subject_name in ("Microsoft Windows Hardware Compatibility Publisher", "Microsoft Windows Software Compatibility Publisher")) and
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                    $entry.callsite_trailing_bytes :
                         ("85c07562488b4b584885c97459488d7b48488974244848897c244048894c243848894c2430488974242848897424204533c94533c033d2488b4b40ff93d80000"))

Field Validations

Loading…

Comments (0)

Loading comments...