Elastic Defend high stable eql

Suspicious Execution via a Mounted Image File

Identifies the execution of a process from a mounted image file. Attacker may abuse IMG files to deliver malicious programs.

View Source

Detection Logic

process where event.action == "start" and
 process.parent.executable : "\\Device\\CdRom0\\*" and
 not process.executable : ("?:\\Program Files\\*.exe",
                           "?:\\Program Files (x86)\\*.exe",
                           "\\Device\\CdRom0\\*") and
 not process.code_signature.trusted == true and
 not (process.parent.name : "setup.exe" and process.executable : "?:\\Users\\*\\AppData\\Local\\Temp\\*.tmp\\setup.tmp") and 
 not process.executable : "?:\\WINDOWS\\regtlib.exe" and 
 not process.hash.sha256 :
            ("632c8f0313f35fc45daa4471f9c8c32075156bc696fb20cd19a33a8c760b1297",
             "5b82b27da9bbaae1abc32095942c60017b275e002cbb2c0cb44580131f4789b4",
             "dafb5d89135fa565080c9c6beafbdeb7611089e946a520001a7ef02facb002d3",
             "18d1bae077da62bb5cf5bfa6a6c5c38ac9ade57f098ea2b357fab477e85f1c25",
             "ab9e0291a763efc32e84e7117f9a0fbc99b681c96df0bb27a66433a726667e5c")

Field Validations

Loading…

Comments (0)

Loading comments...