Elastic Defend high stable eql

Suspicious Execution via ShellBrowserWindow/ShellWindow COM

Identifies suspicious access to the ShellBrowserWindow or ShellWindow COM objects by a Microsoft Office process followed by the execution of commonly abused signed proxy binary. This may indicate an attempt to avoid triggering a suspicious process tree using malicious phishing documents.

View Source

Detection Logic

sequence by user.id with maxspan=5s
  [registry where event.action == "query" and
    process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE", "wscript.exe", "mshta.exe", "cscript.exe", "hh.exe") and
    /* COM - ShellWindows and ShellBrowserWindows can be used to exec a
     process via Explorer and avoid susp process tree */
    registry.key :
      (
      "SOFTWARE\\Classes\\CLSID\\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}*",
      "SOFTWARE\\Classes\\CLSID\\{c08afd90-f2a1-11d1-8455-00a0c91f3880}*")]
   [process where event.action == "start" and
     process.args_count >= 2 and
     (process.parent.executable : "?:\\Windows\\explorer.exe" and process.parent.args_count == 1) and
     /* for now limited to common lolbas + combined to maxspan set to 5s to avoid any unexpected high peak in FPs*/
     process.name :
              ("rundll32.exe",
               "powershell.exe",
               "mshta.exe",
               "msbuild.exe",
               "certutil.exe",
               "regsvr32.exe",
               "cscript.exe",
               "wscript.exe",
               "wmic.exe",
               "msxsl.exe",
               "Microsoft.Workflow.Compiler.exe",
               "ieexec.exe",
               "iexpress.exe",
               "installutil.exe",
               "RegSvcs.exe",
               "RegAsm.exe",
               "AddInProcess.exe") and

     not (process.name : "wscript.exe" and process.args :  "\\\\DC\\netlogon\\*.vbs") and
     not (process.name : "rundll32.exe" and process.command_line : "C:\\Windows\\system32\\Rundll32.exe Prnntfy.dll,AsyncUILoaderEntry Local*")]

Field Validations

Loading…

Comments (0)

Loading comments...