Elastic Defend high stable eql

Suspicious WMI Library Load

Identifies the load of Windows Management Instrumentation related libraries and from suspicious call stack.

View Source

Detection Logic

library where dll.name : ("wbemprox.dll", "WMINet_Utils.dll") and
  process.thread.Ext.call_stack_summary : "ntdll.dll
| kernelbase.dll
| combase.dll
| Unbacked" and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "Unbacked*" and $entry.callsite_trailing_bytes : "?*") and 
 not (process.code_signature.subject_name : ("Acer Incorporated", "Riot Games, Inc.", "Amazon Web Services, Inc.",
      "Bitdefender SRL", "Blizzard Entertainment, Inc.", "JAM Software GmbH", "NetEase (Hangzhou) Network Co., Ltd", "Epic Games Inc.",
      "Essential Objects, Inc.", "EasyAntiCheat Oy") and process.code_signature.status == "trusted") and
 not process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                  $entry.callsite_trailing_bytes : "6a00504883ec300f11442420488d0d3effffff488d542438ff1523ffffff488d0524ffffff488b00f048ff084883c4300f104424f058c34883c4600f105c24c0")

Field Validations

Loading…

Comments (0)

Loading comments...