Elastic Defend high stable eql

RunDLL32/Regsvr32 Loads a DLL Downloaded via BITS

Identifies when RunDLL32 or Regsvr32 loads an executable downloaded via Microsoft BITS Jobs. An adversary may leverage this technique to avoid suspicious processes making network connections and executing a malicious DLL.

View Source

Detection Logic

sequence with maxspan=5m
   [file where event.action : "rename" and
    /* Executable File downloaded via BITS */
    (file.extension : ("dll", "cpl", "ocx") or file.Ext.header_bytes : "4d5a*") and process.name : "svchost.exe" and
    file.Ext.original.name : "BIT*.tmp"] by file.path
   [library where process.name : ("rundll32.exe", "regsvr32.exe") and
    not dll.code_signature.trusted == true and not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
    not dll.path : ("?:\\Program Files (x86)\\*.dll", "?:\\Program Files\\*.dll")] by dll.path

Field Validations

Loading…

Comments (0)

Loading comments...