Elastic Defend high stable eql

Suspicious Java Execution via a Windows Script

Identifies when a Java archive is executed via a Windows Script. This may indicate an attempt to bypass application whitelisting by delivering malicious JAR file via a malicious Windows Jscript or Vbscript.

View Source

Detection Logic

process where event.action == "start" and
  process.name : "Java*.exe" and process.executable : "?:\\Program Files*\\Java\\jre*\\bin\\java*.exe" and
  process.args : "-jar" and process.parent.name : ("wscript.exe", "cscript.exe") and
  process.command_line : ("*\\AppData\\*", "*\\Public\\*", "*\\ProgramData\\*")

Field Validations

Loading…

Comments (0)

Loading comments...