Elastic Defend high stable eql

Shellcode Fluctuation via CallBack

Identifies private (JIT) code memory with fluctuating page protections. This may indicate an attempt to hide injected code from memory scanners.

View Source

Detection Logic

api where process.Ext.api.behaviors in ("execute_fluctuation", "write_fluctuation") and 
 process.Ext.api.behaviors == "proxy_call" and
 process.thread.Ext.call_stack_summary in
            ("ntdll.dll
| kernelbase.dll
| ntdll.dll
| kernel32.dll
| ntdll.dll", "ntdll.dll
| kernelbase.dll
| ntdll.dll
| Unknown") and
 (process.thread.Ext.call_stack_final_user_module.path == "c:\\windows\\system32\\ntdll.dll" or
  process.thread.Ext.call_stack_final_user_module.name == "Undetermined")

Field Validations

Loading…

Comments (0)

Loading comments...