Elastic Defend high stable eql

Startup Persistence via Microsoft Office Descendant Process

Identifies files written to or modified in the startup folder by a Microsoft Office descendant process. Adversaries may use this technique to maintain persistence and to avoid spawning suspicious child processes in an attempt to evade detection.

View Source

Detection Logic

sequence by process.entity_id with maxspan=5m
 [process where event.action == "start" and
  (process.parent.name : ("EQNEDT32.EXE", "WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSPUB.EXE", "MSACCESS.EXE") or
   descendant of [process where event.action == "start" and
                  process.name :
                       ("EQNEDT32.EXE",
                        "WINWORD.EXE",
                        "EXCEL.EXE",
                        "POWERPNT.EXE",
                        "MSPUB.EXE",
                        "MSACCESS.EXE")]) and
   /* Issue #334 */
   not process.Ext.token.integrity_level_name == "system" and
   /* Issue #409 */
   not (process.code_signature.subject_name != null and process.code_signature.subject_name : "Microsoft Corporation" and process.code_signature.trusted == true) and
   not (process.name : "rundll32.exe" and process.args : "?:\\WINDOWS\\system32\\spool\\DRIVERS\\x64\\*" and process.working_directory : "?:\\WINDOWS\\system32\\spool\\DRIVERS\\x64\\*") and
   not process.executable : "?:\\Program Files\\Ebix Inc\\Common Files\\SmartBridgeDXO.exe"
   ]
 [file where event.action != "deletion" and
  file.path : ("?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*",
               "?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\*") and
  /* Issue #334 */
  not file.name : "desktop.ini"]

Field Validations

Loading…

Comments (0)

Loading comments...