Elastic Defend high stable eql

Suspicious DLLRegisterServer Execution via MSIEXEC

Identifies the execution of the built-in Windows Installer, MSIEXEC, to execute code via calling the exported function DLLRegisterServer from a suspicious module.

View Source

Detection Logic

process where event.action == "start" and
 process.pe.original_file_name : "msiexec.exe" and process.args : ("/z", "/y", "-y", "-z") and
 not process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
 not process.Ext.token.integrity_level_name == "system" and
 not (process.parent.executable : "?:\\Windows\\Sys*\\msiexec.exe" and process.parent.args : "/V") and
 not (process.args : "?:\\windows\\system32\\nise.dll" and process.parent.executable : "?:\\Windows\\System32\\runonce.exe")

Field Validations

Loading…

Comments (0)

Loading comments...