Elastic Defend high stable eql

Suspicious Image Load via Windows Scripts

Identifies when a Windows script interpreter loads an unsigned or untrusted external library. This may indicate an attempt to evade detection by executing malicious code via uncommon methods.

View Source

Detection Logic

library where process.name : ("wscript.exe", "cscript.exe", "mshta.exe", "wmic.exe", "cmstp.exe", "msxsl.exe") and

 dll.Ext.relative_file_creation_time <= 500 and

 (dll.code_signature.trusted == false or dll.code_signature.exists == false) and 
 
 not dll.code_signature.status : ("errorChaining", "errorExpired") and 
 
 not dll.path :
       ("?:\\Windows\\assembly\\NativeImages*", 
        "?:\\Windows\\System32\\*",
        "?:\\Windows\\SysWOW64\\*",
        "?:\\Program Files\\*",
        "?:\\Program Files (x86)\\*",
        "?:\\Windows\\WinSxS\\*") and
 not startswith~(process.name, dll.name)

Field Validations

Loading…

Comments (0)

Loading comments...