Elastic Defend high stable eql
Script Execution via MSXSL
Identifies when a Windows Script module is loaded into the Microsoft Core XML Services (MSXML) process. This may indicate an attempt to bypass application whitelisting by executing a malicious script in a trusted process.
Detection Logic
sequence by process.entity_id with maxspan=1m
[process where event.action == "start" and process.pe.original_file_name == "msxsl.exe"]
[library where dll.name : ("scrobj.dll", "jscript.dll", "vbscript.dll", "jscript9.dll")]Field Validations
Loading…
Comments (0)
Loading comments...