Elastic Defend high stable eql

Suspicious File Rename from Unbacked Memory

Identifies a suspicious file rename operation from an unbacked memory region. This may indicate Ransomware behavior from an injected trusted process.

View Source

Detection Logic

sequence by process.entity_id with maxspan=30s
[file where event.action : "rename" and
  process.code_signature.status : "trusted" and
  not process.code_signature.subject_name :
                          ("LEAP SOFTWARE DEVELOPMENTS PTY. LIMITED", "KASEYA US LLC",
                           "Chocolatey Software, Inc.", "Quadient Industrie France", "ACTIFILE LTD") and
  file.extension != null and file.Ext.entropy >= 7 and
  file.Ext.original.name : ("*.jpg", "*.bmp", "*.png", "*.pdf", "*.doc", "*.docx", "*.xls", "*.xlsx", "*.ppt", "*.pptx") and
  not file.extension : ("tmp", "~tmp", "diff", "gz", "download", "bak", "bck", "lnk", "part", "save", "url", "jpg",
                        "bmp", "png", "pdf", "doc", "docx", "xls", "xlsx", "ppt", "pptx") and
  process.thread.Ext.call_stack_summary :
                     ("ntdll.dll
| kernelbase.dll
| Unbacked",
                      "ntdll.dll
| kernelbase.dll
| kernel32.dll
| Unbacked",
					  "ntdll.dll
| kernelbase.dll
| Unknown
| kernel32.dll
| ntdll.dll",
					  "ntdll.dll
| kernelbase.dll
| Unknown
| kernel32.dll
| ntdll.dll",
					  "ntdll.dll
| kernelbase.dll
| kernel32.dll
| Unknown
| kernel32.dll
| ntdll.dll",
                      "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| Unbacked",
                      "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| Unbacked
| kernel32.dll
| ntdll.dll",
                      "ntdll.dll
| Unbacked",
                      "Unbacked",
					  "Unknown")]
[file where event.action : "rename" and
  process.code_signature.status : "trusted" and
  not process.code_signature.subject_name : ("LEAP SOFTWARE DEVELOPMENTS PTY. LIMITED", "KASEYA US LLC", "Chocolatey Software, Inc.") and
  file.extension != null and file.Ext.entropy >= 7 and
  file.Ext.original.name : ("*.jpg", "*.bmp", "*.png", "*.pdf", "*.doc", "*.docx", "*.xls", "*.xlsx", "*.ppt", "*.pptx") and
  not file.extension : ("tmp", "~tmp", "diff", "gz", "download", "bak", "bck", "lnk", "part", "save", "url", "jpg",
                        "bmp", "png", "pdf", "doc", "docx", "xls", "xlsx", "ppt", "pptx") and
  process.thread.Ext.call_stack_summary :
                     ("ntdll.dll
| kernelbase.dll
| Unbacked",
                      "ntdll.dll
| kernelbase.dll
| kernel32.dll
| Unbacked",
					  "ntdll.dll
| kernelbase.dll
| Unknown
| kernel32.dll
| ntdll.dll",
					  "ntdll.dll
| kernelbase.dll
| Unknown
| kernel32.dll
| ntdll.dll",
					  "ntdll.dll
| kernelbase.dll
| kernel32.dll
| Unknown
| kernel32.dll
| ntdll.dll",
                      "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| Unbacked",
                      "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| Unbacked
| kernel32.dll
| ntdll.dll",
                      "ntdll.dll
| Unbacked",
                      "Unbacked",
					  "Unknown")]

Field Validations

Loading…

Comments (0)

Loading comments...