Elastic low deprecated eql

Deprecated - Adobe Hijack Persistence

Detects writing executable files that will be automatically launched by Adobe on launch.

View Source

Detection Logic

file where host.os.type == "windows" and event.type == "creation" and
  file.path : (
    "?:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe",
    "?:\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe",

    /* Crowdstrike specific condition as it uses NT Object paths */
    "\\Device\\HarddiskVolume*\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe",
    "\\Device\\HarddiskVolume*\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe"
  ) and
  not process.name : ("msiexec.exe", "AdobeARM.exe")

Field Validations

Loading…

Comments (0)

Loading comments...