Elastic Defend high stable eql

Suspicious Execution via Microsoft OfficeCmd URL Handler

Identifies Microsoft Local Bridge executable with suspicious arguments that may indicate an attempt to exploit Microsoft ms-officecmd URL handler via an argument injection vulnerability.

View Source

Detection Logic

process where event.action == "start" and
 (process.name : "LocalBridge.exe" and process.command_line : "*ms-officecmd*LaunchOfficeAppForResult*--gpu-launcher*") or
 (process.parent.name : "LocalBridge.exe" and process.parent.command_line : "*ms-officecmd*LaunchOfficeAppForResult*--gpu-launcher*") or
 /* generic condition to capture abuses of Electron Apps --gpu-launcher switch for proxy execution */
 (process.parent.command_line : "*--disable-gpu-sandbox*--gpu-launcher=*" and not process.parent.name : "LocalBridge.exe")

Field Validations

Loading…

Comments (0)

Loading comments...