Elastic Defend high stable eql

Suspicious Image Load by System Protected Process

Identifies when a System protected process loads a library from a network file share. This may indicate an attempt to bypass PPL protection and inject malicious code into a protected process or disable security software.

View Source

Detection Logic

sequence by process.entity_id
 [process where event.action == "start" and process.Ext.protection : "PsProtected*" and 
  not (process.executable : "?:\\Windows\\Microsoft.NET\\Framework\\*\\mscorsvw.exe" and 
       process.parent.executable : "?:\\Windows\\Microsoft.NET\\Framework*\\ngen.exe" and 
       process.Ext.protection : "PsProtectedSignerCodeGen-Light")]
 [library where dll.path : ("\\Device\\Mup\\*", "\\\\127.*\\*")]
  until [process where event.action:"end"]

Field Validations

Loading…

Comments (0)

Loading comments...