Elastic Defend high stable eql

Rundll32 or Regsvr32 Executing an OverSized File

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations

View Source

Detection Logic

sequence with maxspan=5m
 [file where event.action != "deletion" and
  file.Ext.header_bytes : "4d5a*" and not user.id : "S-1-5-18" and

  /* size more or equal to 50MB */
   file.size >= 50000000] as event0
 [process where
  process.name : ("rundll32.exe", "regsvr32.exe", "control.exe") and process.args_count >= 2 and
  startswith~(process.args, event0.file.path) and
  not (process.name : "rundll32.exe" and process.command_line : "*FirewallControlPanel*ShowNotificationDialog*") and
  not (process.name : "regsvr32.exe" and
       process.args : ("?:\\Program Files (x86)\\*",
                       "?:\\Program Files\\*",
                       "?:\\Users\\*\\AppData\\Local\\Microsoft\\TeamsMeetingAddin\\*\\Microsoft.Teams.AddinLoader.dll"))]

Field Validations

Loading…

Comments (0)

Loading comments...