Elastic Defend high stable eql

Suspicious API from an Unsigned Service DLL

Identifies the execution of a new service via unsigned ServiceDLL subsequently followed by suspicious Windows API calls. Adversaries may use this technique to maintain persistence or run with System privileges.

View Source

Detection Logic

sequence by process.entity_id with maxspan=2m
[library where

  (dll.Ext.relative_file_creation_time <= 900 or dll.Ext.relative_file_name_modify_time <= 900) and

  (dll.code_signature.trusted == false or dll.code_signature.exists == false or dll.path : "\\Device\\Mup*") and

  process.executable : ("?:\\Windows\\System32\\svchost.exe", "?:\\Windows\\SysWOW64\\svchost.exe") and

  not dll.hash.sha256 in ("c8bf101bab6d5400f892ee92f2e788a7096192a417707c4fa91f54ee2c29d394", "d615af8e012426c8847c750a0838159d6c41385d2e50388cea28a97999b81614")] as event0
[api where

 process.executable : ("?:\\Windows\\System32\\svchost.exe", "?:\\Windows\\SysWOW64\\svchost.exe") and
  (
    process.Ext.api.name : ("WriteProcessMemory", "VirtualProtectEx") or
   (process.Ext.api.name : ("VirtualAlloc*", "MapViewOfFile*") and
    process.Ext.api.parameters.protection : "*X*" and process.Ext.api.parameters.size >= 4000)
   ) and

 /* API stack is originating from a service DLL */
 _arraysearch(process.thread.Ext.call_stack, $entry, stringcontains~($entry.symbol_info, concat(event0.dll.name, "!ServiceMain")))]

Field Validations

Loading…

Comments (0)

Loading comments...