Elastic Defend high stable eql

Suspicious Windows Service DLL Creation

Identifies the creation of a new service via ServiceDLL registry modification instead of using the Windows Service Control Manager APIs, subsequently loaded by svchost.exe. Adversaries may use this technique to maintain persistence or run with System privileges.

View Source

Detection Logic

registry where event.action == "modification" and 
 registry.value : "ServiceDLL" and process.executable : ("?:\\*", "\\Device\\Mup\\*") and
 not process.executable : ("?:\\Windows\\System32\\services.exe",
                           "?:\\Windows\\System32\\msiexec.exe",
                           "?:\\Windows\\SysWOW64\\msiexec.exe",
                           "?:\\Windows\\System32\\poqexec.exe",
                           "?:\\Windows\\System32\\w32tm.exe",
                           "?:\\Windows\\System32\\spoolsv.exe",
                           "?:\\Windows\\servicing\\TrustedInstaller.exe",
                           "?:\\Windows\\System32\\sdiagnhost.exe",
                           "?:\\Windows\\WinSxS\\*\\TiWorker.exe",
                           "?:\\Windows\\System32\\drvinst.exe",
                           "?:\\Program Files (x86)\\*.exe",
                           "?:\\Program Files\\*.exe",
                           "?:\\Windows\\Temp\\*-*-*\\DismHost.exe",
                           "?:\\$WINDOWS.~BT\\Work\\*\\DismHost.exe",
                           "?:\\$WinREAgent\\Scratch\\*\\DismHost.exe",
                           "?:\\Windows\\SoftwareDistribution\\*.exe",
                           "?:\\Windows\\regedit.exe",
                           "?:\\Windows\\System32\\reg.exe",
                           "?:\\Windows\\System32\\lsass.exe",
                           "?:\\Windows\\System32\\upfc.exe",
                           "?:\\Windows\\System32\\SearchProtocolHost.exe",
                           "?:\\Windows\\SystemApps\\Microsoft.Windows.Search_*\\SearchApp.exe",
                           "?:\\Windows\\System32\\conhost.exe",
                           "?:\\Windows\\System32\\oobe\\UserOOBEBroker.exe",
                           "?:\\Windows\\CCM\\SCNotification.exe",
                           "?:\\Windows\\System32\\PrintIsolationHost.exe",
                           "?:\\Windows\\System32\\sppsvc.exe",
                           "?:\\Windows\\System32\\backgroundTaskHost.exe",
                           "?:\\*\\procexp64.exe",
                           "C:\\Windows\\SystemTemp\\*\\DismHost.exe") and

 not (process.executable : ("?:\\Windows\\System32\\svchost.exe",
                            "?:\\Windows\\System32\\regsvr32.exe",
                            "?:\\Windows\\SysWOW64\\regsvr32.exe",
                            "?:\\Users\\*\\AppData\\Local\\Temp\\*\\DismHost.exe",
                            "?:\\Windows\\Temp\\osrssinst.exe",
                            "?:\\Windows\\regedit.exe",
                            "?:\\$WINDOWS.~BT\\Work\\*\\DismHost.exe") and
      registry.data.strings : ("%systemroot%\\system32\\*", "?:\\Windows\\System32\\*", "%systemroot%\\syswow64\\*",
                               "?:\\Windows\\SysWOW64\\*", "*:\\Program Files\\*", "*:\\Program Files (x86)\\*")) and

 not registry.data.strings : "?:\\WINDOWS\\system32\\spool\\drivers\\x64\\3\\PrintConfig.dll" and

 not (registry.data.strings : "?:\\Program Files (x86)\\dolphinpaper\\provider\\wpprovider.dll" and
      registry.path : "HKLM\\SYSTEM\\ControlSet*\\Services\\dolphinSvc\\Parameters\\ServiceDll") and

 not (process.code_signature.subject_name : ("Speckled Jay LLC", "Refraction Point, Inc", "Arcadia Laboratories Inc.") and process.code_signature.trusted == true) and

 not (process.name : "Dismhost.exe" and registry.data.strings : ("%systemroot%\\system32\\wuaueng.dll", "%SystemRoot%\\System32\\browser.dll") and
      process.code_signature.subject_name : "Microsoft*" and process.code_signature.trusted == true)

Field Validations

Loading…

Comments (0)

Loading comments...