Elastic Defend high stable eql

Suspicious Memory Mapping from a Windows Installer

Identifies suspicious API calls from a Windows Installer module. This behavior is consistent with code injection attacks.

View Source

Detection Logic

api where
   process.parent.executable : "C:\\Windows\\Sys?????\\msiexec.exe" and
   process.Ext.api.name in ("MapViewOfFile", "MapViewOfFile2") and
   process.Ext.api.parameters.size >= 100000 and process.Ext.api.parameters.protection in ("RWX", "R-X") and
   _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == false or $entry.exists == false) and
   _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "C:\\Windows\\Sys?????\\ntdll.dll!NtMapViewOfSection*")

Field Validations

Loading…

Comments (0)

Loading comments...