Elastic Defend high stable eql

Suspicious MS Office Execution via DCOM

Identifies suspicious modification of the Microsoft Office AccessVBOM security setting followed by the execution of another Office process instance via DCOM. This may indicate an attempt to evade detection via suspicious process tree.

View Source

Detection Logic

sequence by user.id with maxspan=1m
   [registry where event.type == "change" and
    registry.path :
          ("HKEY_USERS\\S-1-5-21-*\\SOFTWARE\\Microsoft\\Office\\*\\Security\\AccessVBOM",
           "HKEY_USERS\\S-1-12-1-*\\SOFTWARE\\Microsoft\\Office\\*\\Security\\AccessVBOM") and
    registry.data.strings == "1"]
   [process where event.action == "start" and
    (process.parent.name :("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE") and
     process.parent.args : "-Embedding") and
    not (process.executable : ("?:\\Windows\\System32\\WerFault.exe", "?:\\Windows\\SysWOW64\\WerFault.exe") and process.args : "-u" and process.args : "-p") and
    not (process.pe.original_file_name == "ItSukurti.exe" and process.executable : "?:\\SamExpert\\ItSukurti.exe") and
    not (process.executable : "?:\\WINDOWS\\splwow64.exe" and process.args : "8192") and
    not (process.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe") and process.code_signature.trusted == true) and
    not (process.code_signature.subject_name : ("Essential Objects, Inc.", "REFINITIV US LLC") and process.code_signature.trusted == true)]

Field Validations

Loading…

Comments (0)

Loading comments...