Elastic low stable eql

Image Loaded with Invalid Signature

Identifies binaries that are loaded and with an invalid code signature. This may indicate an attempt to masquerade as a signed binary.

View Source

Detection Logic

library where host.os.type == "windows" and event.action == "load" and
  dll.code_signature.status : ("errorUntrustedRoot", "errorBadDigest", "errorUntrustedRoot") and
  (dll.Ext.relative_file_creation_time <= 500 or dll.Ext.relative_file_name_modify_time <= 500) and
  not startswith~(dll.name, process.name) and
  not dll.path : (
    "?:\\Windows\\System32\\DriverStore\\FileRepository\\*"
  )

Field Validations

Loading…

Comments (0)

Loading comments...