Elastic Defend high stable eql

Suspicious Execution from a PDF Documents

Identifies a suspicious execution from a PDF document with embedded objects. This behavior is consistent with the successful exploitation using spearphishing attachment.

View Source

Detection Logic

process where event.action == "start" and
 (
  (process.parent.name : "AcroRd*.exe" and
   process.name : ("chrome.exe", "firefox.exe", "msedge.exe", "cscript.exe", "wscript.exe",
                   "mshta.exe", "powershell.exe", "hh.exe", "cmd.exe") and
   process.args : "?:\\Users\\*\\AppData\\Local\\Temp\\acrord*_sbx\\*") or

  (process.parent.name : ("chrome.exe", "firefox.exe", "msedge.exe") and process.parent.args : "?:\\Users\\*\\AppData\\Local\\Temp\\acrord*_sbx\\*" and
   not process.name : ("chrome.exe", "firefox.exe", "msedge.exe")) or

  (process.executable : "?:\\Users\\*\\AppData\\Local\\Temp\\acrord*_sbx\\*" and
   not process.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*"))
 )

Field Validations

Loading…

Comments (0)

Loading comments...