Elastic Defend high stable eql

Suspicious Image Load from SMB Shares

Identifies the load of a DLL from a network file share followed by a suspicious DLL load event. Adversaries may leverage this technique to avoid dropping to disk the malicious payload on the targeted machine.

View Source

Detection Logic

sequence by process.entity_id with maxspan=1m
 [library where dll.path : "\\Device\\Mup\\*" and not startswith~(dll.name, process.name) and 
  not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.symbol_info : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "?:\\Windows\\Sys*\\tmumh\\*\\tmmon.dll+*")) and
  not process.executable :
            ("?:\\Windows\\System32\\sdiagnhost.exe",
             "?:\\Windows\\System32\\CompPkgSrv.exe",
             "?:\\Windows\\System32\\backgroundTaskHost.exe") and 
  not process.thread.Ext.call_stack_summary : "ntdll.dll
| kernelbase.dll
| jvm.dll
| java.dll
| Unbacked"
  ]
 [library where
  process.executable != null and
  (
   (dll.name : ("ws2_32.dll", "wininet.dll", "psapi.dll") and
    process.thread.Ext.call_stack_summary == "ntdll.dll
| kernelbase.dll
| Unbacked") or

   dll.name : ("dsquery.dll", "System.Management.Automation.dll")
  ) and 
  not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
  not (dll.name : "ws2_32.dll" and process.executable : "\\Device\\Mup\\*.edu\\*\\IDTest.exe") and 
  not (dll.name : "wininet.dll" and process.executable : "\\Device\\Mup\\nf01\\Application\\*.exe") and 
  not (process.name : "UiPath.ActivityCompiler.CommandLine.exe" and process.code_signature.subject_name : "UiPath, Inc." and 
       process.code_signature.trusted == true and dll.name : "System.Management.Automation.dll") and 
       
  not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.callsite_leading_bytes :
                         ("ffeb1e8d4e0ce86482000083660400684c5*",
                          "8bcee8ac9affff837d10007414ff7510*",
                          "0000004d63db4a8b0c19488b0948894d9890488b4db84533db488b458048898558ffffff488d051500000048898570ffffff488b4588c6400c00488b4598ffd0",
                          "8b750cc706d3c6ca05e8cd9d2e588b4d10e855d728588b4d108b750cc706dec6ca05e884102d588b4d10e8dcf72c588b4d108b750cc706e6c6ca05e89b9d2e58",
                          "008bc3eb8933c0413bed75824488afe81c0000e976ffffffcccccc40534881eca000000033db48391d66360d000f85bb010000488d0db9580b00ff15132b0900"))
  ]

Field Validations

Loading…

Comments (0)

Loading comments...