Elastic Defend high stable eql

Suspicious DNS Query by MSIEXEC

Identifies DNS queries by MSIEXEC to suspicious DNS domains related to potentially unwanted software delivered via Windows installers.

View Source

Detection Logic

dns where process.name : "msiexec.exe" and
  dns.question.name like ("check-key.com", "key-needs.com", "key-crack.com", "get-lic.com", "get-license?.com",
                          "software-license?.com", "*.postomodelo.com", "to-license?.com", "lifehackov.ru",
                          "cld.pt", "to-lic.com", "downloader.yandex.net", "clck.yandex.ru", "key-needs.com")

Field Validations

Loading…

Comments (0)

Loading comments...