Elastic medium stable eql

Signed Proxy Execution via MS Work Folders

Identifies the use of Windows Work Folders to execute a potentially masqueraded control.exe file in the current working directory. Misuse of Windows Work Folders could indicate malicious activity.

View Source

Detection Logic

process where host.os.type == "windows" and event.type == "start" and
  process.name : "control.exe" and process.parent.name : "WorkFolders.exe" and
  not process.executable : (
    "?:\\Windows\\System32\\control.exe",
    "?:\\Windows\\SysWOW64\\control.exe",

    /* Crowdstrike specific condition as it uses NT Object paths */
    "\\Device\\HarddiskVolume*\\Windows\\System32\\control.exe",
    "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\control.exe"
  )

Field Validations

Loading…

Comments (0)

Loading comments...