Elastic Defend high stable eql

Suspicious Microsoft Office Embedded Object

Identifies suspicious file extensions written by a Microsoft Office process from an embedded OLE stream, this is frequently used by malicious documents to drop malicious content for initial access.

View Source

Detection Logic

file where event.action != "deletion" and process.name : ("winword.exe", "excel.exe", "powerpnt.exe") and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: ("*!OleSaveToStream*", "*!OleLoad*")) and
 (
  file.extension : ("exe", "dll", "js", "vbs", "vbe", "jse", "url", "chm", "bat", "mht", "hta", "search-ms") or

  /* PE & HelpFile */
  file.Ext.header_bytes : ("4d5a*", "49545346*")
  )

Field Validations

Loading…

Comments (0)

Loading comments...