Elastic Defend high stable eql

Suspicious Registry Symbolic Link

Identifies the creation of registry symbolic link by an unusual process. This may indicate an attempt to elevate privileges via hijacking privileged registry read operations using a malicious registry symbolic link.

View Source

Detection Logic

registry where event.action == "modification" and user.id : ("S-1-5-21*", "S-1-12-*") and
registry.value : "SymbolicLinkValue" and process.executable : "?:\\*" and
 not process.executable :
            ("?:\\Windows\\System32\\DriverStore\\FileRepository\\*", 
	     "?:\\Windows\\System32\\svchost.exe", 
             "?:\\Program Files\\*.exe", 
	     "?:\\Program Files (x86)\\*.exe", 
             "?:\\Windows\\Temp\\asw-*\\avg-av\\icarus.exe", 
	     "?:\\$WINDOWS.~BT\\Work\\*\\DismHost.exe") and
 not (process.code_signature.trusted == true and not process.code_signature.subject_name : "Microsoft*") and
 not (process.name : "DismHost.exe" and process.code_signature.trusted == true and process.code_signature.subject_name : "Microsoft *") and
 not (process.executable : "?:\\Windows\\System32\\msiexec.exe" and registry.path : "HKEY_USERS\\*\\Software\\Nico Mak Computing\\SymbolicLinkValue")

Field Validations

Loading…

Comments (0)

Loading comments...