Elastic Defend high stable eql
Shellcode Injection with Parent as Provenance
Identifies when a process attempts to allocate or execute shellcode from an unbacked memory and where the protection provenance of that memory region is coming from the parent process.
Detection Logic
api where process.Ext.api.behaviors in ("allocate_shellcode", "shellcode") and
process.Ext.api.behaviors != "cross-process" and process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and
_arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == false or $entry.exists == false) and
process.thread.Ext.call_stack_final_user_module.hash.sha256 != null and
process.thread.Ext.call_stack_final_user_module.protection_provenance_path != null and
not (process.Ext.api.parameters.size <= 4096 and process.Ext.api.name == "VirtualProtect") and
not process.Ext.api.metadata.target_address_path : ("c:\\windows\\syswow64\\user32.dll", "c:\\windows\\syswow64\\gdi32.dll") and
startswith~(process.thread.Ext.call_stack_final_user_module.protection_provenance_path, process.parent.executable) and
not (process.executable : "C:\\Program Files (x86)\\*.exe" and process.parent.executable : "C:\\Program Files\\*.exe") and
not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
("e9b488ad3101d386a3b2248db0c0dfe43c83fd856c55d181264da762f5352f38",
"4ad4ff7561647775372cafe7c52ba85d610dbc901a45f1a576764dfa11a9fa7a",
"10f3e16e8428f3d411f099fc4ff6e5b6f3ece29a0fc8fc606e7148e2f9bfc84b",
"83fecf04fc83a08c78e4f5faad39c4b4ecb806c2b777c58998bfc9ea560f17ca",
"6a31d5d8358cd60014233b39f33f2dda2cf6cc5c4883ba1501dc37644d2b51b4",
"83fecf04fc83a08c78e4f5faad39c4b4ecb806c2b777c58998bfc9ea560f17ca",
"33d3d3b2872d65e0584668d6d4ef1520b9fe25fe55f9e3174696274309ceb3e0",
"36c190fb1081298ca8ed7e9e2a46e9e535a265534a99283bd0ee2d144ddeeba4",
"d94ad7bcd32ec7b48fe76a4293205c6eb17191b7882a631ccb4eeabee2a96bca",
"f6ec8ebfe3ef1f9b74ecfadffa03de8fb23cdefead9cb7c87c59c0e036b85e2f",
"420efa8de496e3cfbc91910ae59f730d253280ddb2ab3daff484afc3eb0c89b6",
"0f7fd870dd2e7272b92ea5dfe88b2662d859818459a3d2c1e9d669aa1a7dddc2",
"ce4d31db584ad5ff31a8e81c735e81a42f87cd37b70cfdf3d3621a794dacf3d1",
"02f9581f9b917ac8535bce97462ad587608fd42227eae4d8ee54ab7a4bf742fd",
"b3d665fa5452b58a2238f57188aa9310a01a1e3c2b884269c2bccb0bdadabd41",
"6d72df875440edd9216e2e3f0fb500776064a6f2e412f8d118e410760dff3685",
"6a31d5d8358cd60014233b39f33f2dda2cf6cc5c4883ba1501dc37644d2b51b4",
"27c7d20101e03ec0850cdd58f89b8d5e8494e8c0790919c778947ca14ee68a0d",
"38e175cd1d4a2acd6ee0f04b2045c6260a7362a1cde2c77bca5887e0811edd2f",
"3ec7799d1f23fc6c0beea6f237f801dbdd59aac6faa7a22ecf88ba54c8fc9a80",
"e54d84398581083d4a4c2ca95056cbfffc1183d54fedfb4cf1b68bf1b4495839",
"43e216dbaf5aaad2d0b7d63dd14a9ce5b060390271e46fedbe59c671cfb28714",
"a8448fdad13341552eddecdbef4225015aa9940abe47d52d358a36f7bae57cc1",
"b18aa0c98922563f5996fb0497446873f7030d0511ffb77388ea882b4f98a924",
"ec673caa0c703cc3084887824b800502cd45b4a365c2f8d6cbc5175f0e938e1e",
"fee37bdeecc597ad9e0f13264e9ac12df3ad41f8d76a41da6e38349ed66ab35e",
"ce00bc44c975337198e7d3d353b8a1789a1221697754957752a63bbf547f1334",
"a87b3f02042de4d655f72af65ed5242fae5c675bebd19e962978c13e6d99ba00",
"85060dfab7e73f3986a4fa6148e7c14b0df55ba812c7367d85bd580837b2f7a4",
"a543689f34083f810e0184ec77d8ee9e57d44ebd6212af444853a3a89a3c82c0",
"9096bba37319bcd1b809a72cd359066788199c859a67a5d872ae1b22ed0dd842",
"b7b98dd681dfea2333a0136ba5788e38010730bb2e42eafa291b16931f00449d",
"a99cd58ec2becb2aaf2625659e42816c45e62297db468767d74f279046d98759",
"a2b2c7eb257e2be7100f735db3a772279c88ee913ffb6111b14d81685fd5f035",
"a99cd58ec2becb2aaf2625659e42816c45e62297db468767d74f279046d98759",
"f1b584d0871d1600528abdf4e6693360237c66e066dac2087e0e565d9d6a3d73",
"eb30a0075cdc0c3ddea9b22b92e4d0f275932f9fdcb10b9d4d4bd8b3c03da0be",
"d5fff843645ab47000738a36b7073f1d0e7c2cd4cc8612ce7325ef4da8cd7412",
"b6cbd6fd5caebf165ef854813a81ff800f98858a1d60cc0b6a401b21d28b622a",
"ea9afbb6e39625961698c86066dfe1ffc8ced0102360c5baa25493408af8c253",
"073453a10735f07728f0226aff69799d23aaac9a8ec9a15baee297cbd5c66cf8",
"36141b686ae3edc68e33bca2b4774539501df365b03c5703d4a74219e869aedb",
"f359110a232e73618eb0af7780d93f7b95dd269e3d12eefa9150784d95f32f91",
"e0af24d54621935df1b9956ed68f46cb92ef8c711101ba1683dfe7f41e7cdcae",
"b894515db9f9e3ad157e11c1f1e558c589c60567033880409874293cca8f8f81",
"8d3f6fe71b24882d9f51e4c298335dfd19c9acfb2473e5e0dcae5b5b4b447c4c",
"79dafa6bf1054b901448a76f7f441d4c458f5eb2b6e9ab87e39632fb313c0d84",
"c10ef947b23cc2ef4f339212123a4ac2c08df8ecb2c19658384a448427adf104",
"0cd9e13dbce7595879d9e972dc04e81da63d1cbf34c99fd3603e2aba68ccf2a5",
"91255773e0347a72a8e33c7d3d1f4ca89939d0bcc88c8c53c12872e2979b13cc",
"bf041dddc12576146b15dfe718c721901c9dfc0c041a62315058a2456a4ee854",
"23a1dde1e71d79ab7d4097c7f997a9f6fe3fd3ddaefeef267bf14554461c9bd7",
"dc2844b3ce298adf6001ce3814f43df73950aa08dda8824173c0ad158d649740",
"ad92c48ec5e6416b0986536236d5c771b63b98b84e5c1f172f1ab7a5779baac6",
"f621aa32815a28d5d1e01647522df9d9c8f5055b318cd3bd303a9cfb7eed5825",
"0801daddddc3bace3ae059513993d306cead3cca0652f7167e870f5a60f48779",
"ec53f8964b89b6e5c01df862734a97798b4eeb7b1e14c557f7c71ee72fe87779",
"da670f3718e4c465eb2382e4b3da25b479ac868056c4f532b526036786a703e9")Field Validations
Loading…
Comments (0)
Loading comments...