Elastic medium stable eql

Suspicious Shell Execution via Velociraptor

Detects shell executions (cmd, PowerShell, rundll32) spawned by Velociraptor. Threat actors have been observed installing Velociraptor to execute shell commands on compromised systems, blending in with legitimate system processes.

View Source

Detection Logic

process where host.os.type == "windows" and event.type == "start" and process.command_line != null and
 process.parent.name : "velociraptor.exe" and
 process.name : ("cmd.exe", "powershell.exe", "rundll32.exe") and
 not (process.name : "powershell.exe" and process.command_line : "*RwBlAHQALQBMAG8AYwBhAGwARwByAG8AdQBwAE0AZQBtAGIAZQBy*") and
 not (process.name : "powershell.exe" and process.command_line : "*RwBlAHQALQBEAGEAdABl*" and process.command_line : "*-Format*") and
 not (process.name : "cmd.exe" and process.command_line : "*start*127.0.0.1:8889*") and
 not (process.name : "powershell.exe" and process.command_line : "*RwBlAHQALQBJAHQAZQBt*" and process.command_line : "*UgBlAGcAaQBzAHQAcgB5*" and process.command_line : "*UgB1AG4A*") and
 not (process.name : "powershell.exe" and
      process.args : ("RwBlAHQALQ*", "UgBlAG0AbwB2AGUALQBJAHQAZQBtACA*", "C:\\Program Files\\Velociraptor\\thor.db",
                      "import-module \"C:\\Program Files\\Velociraptor\\Tools\\*"))

Field Validations

Loading…

Comments (0)

Loading comments...