Elastic Defend high stable eql

Suspicious File Rename by an Unusual Process

Identifies the execution of commonly abused signed proxy execution utilities such as rundll32, regsvr32 and powershell followed by a suspicious file rename operation. This may indicate Ransomware behavior leveraging legit Windows utilities.

View Source

Detection Logic

sequence by process.entity_id with maxspan=5m
 [process where event.action == "start" and process.name : ("rundll32.exe", "regsvr32.exe")]
 [file where event.action : "rename" and
  file.extension != null and file.Ext.entropy >= 7 and
  file.Ext.original.name : ("*.jpg", "*.bmp", "*.png", "*.pdf", "*.doc", "*.docx", "*.xls", "*.xlsx", "*.ppt", "*.pptx") and
  not file.extension : ("tmp", "~tmp", "diff", "gz", "download", "bak", "bck", "lnk", "part", "save", "url", "jpg", "bmp",
                        "png", "pdf", "doc", "docx", "xls", "xlsx", "ppt", "pptx")]

Field Validations

Loading…

Comments (0)

Loading comments...