Elastic Defend high stable eql

Suspicious ImageLoad from an ISO Mounted Device

Identifies instances of RunDLL32, Regsvr32 or Odbcconf loading a DLL from a mounted ISO device. Adversaries may deliver a malicious payload via an ISO file and execute it via rundll32.exe, regsvr32 or Odbcconf.

View Source

Detection Logic

sequence by process.entity_id with maxspan=1m
 [process where event.action == "start" and
  process.name : ("rundll32.exe", "regsvr32.exe", "odbcconf.exe", "certoc.exe") and
  process.parent.name : ("cmd.exe", "explorer.exe", "powershell.exe", "winrar.exe", "7zFM.exe")]
 [library where process.name : ("rundll32.exe", "regsvr32.exe", "odbcconf.exe", "certoc.exe") and
  not dll.code_signature.trusted == true and not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and

  /* loading dll from a mounted device */
  (dll.path : "\\Device\\CdRom*" or dll.path regex """[d-zD-Z]:\\[0-9a-zA-Z\.]+""")]

Field Validations

Loading…

Comments (0)

Loading comments...