Elastic Defend high stable eql

Scriptlet Proxy Execution via PubPrn

Adversaries may use the trusted PubPrn script to proxy execution of malicious files. This behavior may bypass signature validation restrictions and application control solutions that do not account for use of these scripts.

View Source

Detection Logic

process where event.action == "start" and
 process.pe.original_file_name in ("cscript.exe", "wscript.exe") and process.args_count >= 4 and
 /* Issue 259 - additional rule strictness */
 process.command_line : ("*localhost*script:http*", "*127.0.0.*script:http*")

Field Validations

Loading…

Comments (0)

Loading comments...