Elastic Defend high stable eql

WaaSMedicSvc COM Type Lib Hijack

Identifies registry modification to the original WaaSMedicSvc COM TypeLib registry key used as a primitive to hijack the normal behaviour of this service for evasion and privileges elevation.

View Source

Detection Logic

registry where
 registry.path : 
        ("HKLM\\SOFTWARE\\Classes\\TypeLib\\{3ff1aab8-f3d8-11d4-825d-00104b3646c0}\\*\\Win??\\", 
         "HKEY_USERS\\*Classes\\TypeLib\\{3ff1aab8-f3d8-11d4-825d-00104b3646c0}\\*\\Win??\\") and
 registry.data.strings != null and 
 not (user.id : "S-1-5-18" and process.executable : "?:\\windows\\system32\\svchost.exe" and 
      registry.data.strings : "?:\\WINDOWS\\system32\\WaaSMedicPS.dll")

Field Validations

Loading…

Comments (0)

Loading comments...