Elastic Defend high stable eql

Suspicious Service ImagePath Value

Identifies the creation of a Windows service with a suspicious ImagePath value. Adversaries may use this technique to maintain persistence or run with System privileges.

View Source

Detection Logic

registry where registry.path : "HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\ImagePath" and

   registry.data.strings != null and

   registry.data.strings : ("*COMSPEC*", "*\\172.0.0.1*", "*Admin$*", "*powershell*", "*rundll32*", "*NTDS\\ntds.dit*",
                            "*HarddiskVolumeShadowCopy*") and

   not registry.data.strings :
                     ("?:\\Windows\\system32\\rundll32.exe ?:\\Windows\\SYSTEM32\\INTERP~2.DLL,eb_service",
                      "%SystemRoot%\\System32\\rundll32.exe \"C:\\Windows\\Downloaded Program Files\\urxdialer.dll\",EmergencyCleanup",
                      "%COMSPEC% /Q /c start*pzaS5TZXJ2aWNlTmFtZSA9ICJPMjRBVVRIIjs*",
                      "\"C:\\Program Files (x86)\\*", "\"C:\\Program Files\\*")

Field Validations

Loading…

Comments (0)

Loading comments...