Elastic Defend high stable eql

Remote Process Injection via Python

Identifies attempt to perform remote process code injection from a python program.

View Source

Detection Logic

api where process.Ext.api.behaviors == "cross-process" and process.Ext.api.metadata.target_address_name like "?*" and
 process.thread.Ext.call_stack_final_user_module.name : ("libffi*.dll", "python*.dll") and
 not process.Ext.api.metadata.target_address_name in ("PEB", "PEB32", "ProcessStartupInfo") and
 not process.Ext.api.summary like ("* PEB*", "* PEB32*", "*ProcessStartupInfo*", "*Data*", "*python??.dll*", "NtQueueApcThread( cmd.exe, Unbacked, NULL, NULL, NULL )") and
 not process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*.exe") and
 not (process.Ext.api.name == "WriteProcessMemory" and process.Ext.api.parameters.size == 4) and
 not process.thread.Ext.call_stack_final_user_module.path like
                                  ("c:\\program files\\*.dll",
                                   "c:\\program files (x86)\\*.dll",
                                   "c:\\programdata\\anaconda3\\python??.dll",
                                   "c:\\windows\\systemtemp\\chrome_unpacker_*\\python*.dll")

Field Validations

Loading…

Comments (0)

Loading comments...