Elastic Defend high stable eql

Suspicious Image File Execution Options Modification

The Debugger and SilentProcessExit registry keys can allow an adversary to intercept the execution of files, causing a different process to be executed. This functionality can be abused by an adversary to establish persistence.

View Source

Detection Logic

registry where registry.data.strings != null and process.executable != null and 
 registry.path : ("HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\*.exe\\Debugger",
                  "HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\*\\Debugger",
                  "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*\\MonitorProcess",
                  "HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*\\MonitorProcess") and
   /* add FPs here */
 not registry.data.strings :
          ("?:\\Program Files*\\ThinKiosk\\thinkiosk.exe",
           "*\\PSAppDeployToolkit\\*",
           "%windir%\\System32\\taskkill.exe",
           "ntsd -d",
           "%1",
           "?:\\Program Files (x86)\\Siemens\\WinCC\\bin\\CCHelpStarter.exe",
           "SppExtComObjPatcher.exe",
           "rundll32.exe SppExtComObjHook.dll,PatcherMain",
           "rundll32.exe SECOPatcher.dll,PatcherMain",
           "C:\\Windows\\System32\\systray.exe",
           "C:\\Program Files (x86)\\CryptoLocker Prevention\\ShadowGuard.exe",
           "\"C:\\Program Files\\SolarWinds\\Orion\\Licensing\\Migration.exe\" /hooked",
           "\"C:\\Program Files (x86)\\FastTrack Software\\Admin By Request\\AdminByRequest.exe\" /AutoElevate",
           "\"C:\\Program Files (x86)\\SolarWinds\\Orion\\Licensing\\Migration.exe\" /hooked") and
 not (process.executable : "?:\\Windows\\System32\\svchost.exe" and registry.data.strings : "svchost.exe") and
 not process.executable :
             ("?:\\Program Files\\*.exe",
              "?:\\Program Files (x86)\\*.exe",
              "?:\\Windows\\SysWOW64\\MonitorConsole.exe",
              "?:\\Windows\\SoftwareDistribution\\Download\\Install\\PatchMyPC-ScriptRunner.exe",
              "?:\\ProgramData\\Heimdal Security\\Heimdal Thor Agent\\bin\\Heimdal.Wizard.exe") and
 not (process.code_signature.subject_name : ("Patch My PC, LLC", "EXPRSVPN LLC", "Nasiboot_USB", "FastTrack Software Aps", "Admin By Request ApS") and process.code_signature.trusted == true)

Field Validations

Loading…

Comments (0)

Loading comments...