Elastic Defend high stable eql

Suspicious Execution via DotNet Remoting

Identifies suspicious execution via DotNet system runtime remoting to execute malicious assembly via named pipes. This may indicate an attempt to bypass application control via trusted windows binaries.

View Source

Detection Logic

process where event.action == "start" and process.parent.name : "?*" and
  (process.name : "AddInProcess.exe" or process.pe.original_file_name == "AddInProcess.exe") and

   /* guid point to the pipe name used to pass the malicious assembly and pid point to a running process to wait for before exit */
   process.args : "/guid*" and process.args : "/pid*" and 

   not process.parent.executable : ("?:\\Program Files\\Autodesk\\*.exe",  "?:\\Program Files\\KAPPA\\Workstation *\\Launcher\\KAPPA.exe") and

   not (process.parent.code_signature.subject_name : ("Autodesk, Inc.", "KAPPA Engineering") and process.parent.code_signature.trusted == true)

Field Validations

Loading…

Comments (0)

Loading comments...