Elastic Defend high stable eql

Renamed Third Party Administrator Tools

Identifies third party administrative tools commonly used by adversaries but running with unexpected file names.

View Source

Detection Logic

process where event.action == "start" and
  (
   (process.pe.original_file_name : "procdump" and 
    process.code_signature.subject_name == "Microsoft Corporation" and not process.name : "*procdump*.exe") or
   (process.pe.original_file_name : "psexec.c" and process.code_signature.subject_name == "Microsoft Corporation" and not process.name : "*psexec*.exe") or
   (process.pe.original_file_name : "sdelete.exe" and process.code_signature.subject_name == "Microsoft Corporation" and not process.name : "*sdelete*")
  ) and
  not process.executable :
    ("?:\\Windows\\System32\\*.exe", 
	 "?:\\Windows\\SysWOW64\\*.exe", 
	 "?:\\Program Files (x86)\\*.exe", 
	 "?:\\Program Files\\*.exe")

Field Validations

Loading…

Comments (0)

Loading comments...