Elastic medium stable eql

Registry Persistence via AppCert DLL

Detects attempts to maintain persistence by creating registry keys using AppCert DLLs. AppCert DLLs are loaded by every process using the common API functions to create processes.

View Source

Detection Logic

registry where host.os.type == "windows" and event.type == "change" and
  registry.path : "*\\SYSTEM\\*ControlSet*\\Control\\Session Manager\\AppCertDLLs\\*"

Field Validations

Loading…

Comments (0)

Loading comments...