Elastic Defend high stable eql

Suspicious Windows Service Execution

Identifies the execution of a Windows service from suspicious path such as mounted localhost admin share. This may indicate an attempt to elevate privileges via windows services.

View Source

Detection Logic

process where event.action == "start" and
  process.parent.name : "services.exe" and
  process.Ext.token.integrity_level_name == "system" and
  (
   process.executable : ("\\\\127.0.0.1\\*", "\\Device\\Mup\\*\\c$\\*", "\\Device\\Mup\\*\\ADMIN$\\*") or

   /* Silver psexec default pattern */
   (process.command_line : "?:\\windows\\Temp\\*.exe \"\"" and process.args_count == 2)
   ) and
   not process.executable : ("\\\\ENT*\\admin$\\smstsvc_passive_*.exe", "\\Device\\Mup\\*\\c$\\Program Files\\SIXPaymentServicesLtd\\*\\eftdvs.exe")

Field Validations

Loading…

Comments (0)

Loading comments...