Elastic Defend high stable eql

System Boot Files Permission Change

Identifies attempts to change file ownership of system boot critical files. Adversaries may modify file or directory ownership to evade access control lists (ACLs) and access protected files.

View Source

Detection Logic

process where event.action == "start" and
  (
   ((process.name : "icacls.exe" or process.pe.original_file_name  == "iCACLS.EXE") and (process.args : "/reset" or (process.args : "/grant" and process.args : "Everyone:F"))) or
   ((process.name : "takeown.exe" or process.pe.original_file_name == "takeown.exe") and process.args : "/f")
   ) and
   process.command_line : ("*winload.exe*", "*winload.efi*", "*ntoskrnl.exe*", "*bootmgr*")

Field Validations

Loading…

Comments (0)

Loading comments...