Elastic Defend high stable eql

Scriptlet Execution via Rundll32

Identifies when scrobj.dll is loaded into rundll32.exe. An adversary may abuse rundll32.exe to proxy execution of malicious code.

View Source

Detection Logic

sequence by process.entity_id with maxspan=1m
 [process where event.action == "start" and process.pe.original_file_name == "RUNDLL32.EXE" and
  process.command_line : "*advpack*LaunchINFSection*"]
 [library where dll.name : "scrobj.dll"]

Field Validations

Loading…

Comments (0)

Loading comments...