Elastic Defend high stable eql

Startup Persistence from Backed RWX Memory

Identifies when a process is writing to commonly abused persistence locations (registry run keys and startup folder) from a thread running from a memory section with read, write and execute permissions. This may indicate an attempt to persist from a packed or injected program.

View Source

Detection Logic

any where event.category in ("registry", "file") and process.executable != null and
 not event.action in ("deletion", "query") and process.thread.Ext.call_stack_summary like "?*" and
 not process.code_signature.status like ("trusted", "errorExpired", "errorCode_endpoint*") and
 not process.thread.Ext.call_stack_summary like ("*Unbacked*", "*clr.dll*", "*Unknown*", "*
| kernelbase.dll
| irsetup.exe*", 
                                              "*issetup.dll
| isrt.dll*", "*adobepim.dll
| set-up.dat*") and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.protection : "RWX") and
   (
    (registry.data.strings != null and
     registry.path :
        ("H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*", 
	 "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*", 
         "H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*", 
	 "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*")) or
    (file.name != null and file.path : "?:\\*\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*")
   ) and
   not (process.executable : "?:\\Windows\\Sys*\\msiexec.exe" and
       _arraysearch(process.thread.Ext.call_stack, $entry,
	                $entry.protection : "RWX" and $entry.symbol_info : ("?:\\Windows\\Temp\\*", "?:\\Windows\\Installer\\*"))) and 
   not _arraysearch(process.thread.Ext.call_stack, $entry,
	                $entry.protection : "RWX" and
	                $entry.symbol_info : ("?:\\Windows\\Installer\\*",
	                                      "?:\\Users\\*\\AppData\\Local\\Temp\\*\\isrt.dll!_RegSetKeyValue+*",
	                                      "?:\\Users\\*\\AppData\\Local\\Temp\\{*}\\ISSetup.dll!InstallEngineTypelib*",
	                                      "?:\\Program Files (x86)\\Gizmo\\gdrive.dll!Remount_Startup_Images*")) and
   not registry.data.strings : ("?:\\windows\\Twain_32\\fjscan32\\FjtwMkup.exe /Station", "\"C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Webex\\Webex.lnk\" /minimized /autostartedWithWindows=true") and
   not (process.executable :  "?:\\Windows\\SysWOW64\\DWRCS.EXE" and registry.data.strings : "?:\\WINDOWS\\SysWOW64\\DWRCST.exe") and
   not process.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe")

Field Validations

Loading…

Comments (0)

Loading comments...