Elastic Defend high stable eql

Unusual Process Running as Antimalware Protected

Identifies when commonly abused signed binaries are running as Antimalware Light protection level. This may indicate an attempt to bypass PPL protection and inject malicious code into a protected process or disable security software.

View Source

Detection Logic

process where event.action == "start" and

(process.Ext.protection == "PsProtectedSignerAntimalware-Light" and
   process.pe.original_file_name :
     ("AddInProcess.exe",
      "AddInProcess32.exe",
      "AddInUtil.exe",
      "AppLaunch.exe",
      "aspnet_compiler.exe",
      "aspnet_regbrowsers.exe",
      "aspnet_regiis.exe",
      "aspnet_regsql.exe",
      "aspnet_state.exe",
      "aspnet_wp.exe",
      "CasPol.exe",
      "ComSvcConfig.exe",
      "csc.exe",
      "cvtres.exe",
      "DataSvcUtil.exe",
      "EdmGen.exe",
      "ilasm.exe",
      "InstallUtil.exe",
      "jsc.exe",
      "Microsoft.Workflow.Compiler.exe",
      "MSBuild.exe",
      "mscorsvw.exe",
      "ngen.exe",
      "ngentask.exe",
      "RegAsm.exe",
      "RegSvcs.exe",
      "ServiceModelReg.exe",
      "vbc.exe",
      "WsatConfig.exe",
      "dllhost.exe",
      "regsvr32.exe",
      "GPUpdate.exe",
      "SearchProtocolHost.exe",
      "msiexec.exe",
      "powershell.exe",
      "cmd.exe",
      "rundll32.exe",
      "regsvr32.exe",
      "mshta.exe")) or

descendant of
 [process where event.action == "start" and
  process.Ext.protection == "PsProtectedSignerAntimalware-Light" and
  process.pe.original_file_name :
     ("AddInProcess.exe",
      "AddInProcess32.exe",
      "AddInUtil.exe",
      "AppLaunch.exe",
      "aspnet_compiler.exe",
      "aspnet_regbrowsers.exe",
      "aspnet_regiis.exe",
      "aspnet_regsql.exe",
      "aspnet_state.exe",
      "aspnet_wp.exe",
      "CasPol.exe",
      "ComSvcConfig.exe",
      "csc.exe",
      "cvtres.exe",
      "DataSvcUtil.exe",
      "EdmGen.exe",
      "ilasm.exe",
      "InstallUtil.exe",
      "jsc.exe",
      "Microsoft.Workflow.Compiler.exe",
      "MSBuild.exe",
      "mscorsvw.exe",
      "ngen.exe",
      "ngentask.exe",
      "RegAsm.exe",
      "RegSvcs.exe",
      "ServiceModelReg.exe",
      "vbc.exe",
      "WsatConfig.exe",
      "dllhost.exe",
      "regsvr32.exe",
      "GPUpdate.exe",
      "SearchProtocolHost.exe",
      "msiexec.exe",
      "powershell.exe",
      "pwsh.exe",
      "cmd.exe",
      "rundll32.exe",
      "regsvr32.exe",
      "mshta.exe")]

Field Validations

Loading…

Comments (0)

Loading comments...