Elise Backdoor Activity

{
  "process_creation": {
    "EventID": 4688,
    "Channel": "Security"
  },
  "selection_other_svchost": {
    "NewProcessName
| endswith": "\\Microsoft\\Network\\svchost.exe"
  },
  "selection_other_del": {
    "CommandLine
| contains
| all": [
      "\\Windows\\Caches\\NavShExt.dll",
      "/c del"
    ]
  },
  "selection_dll_path": {
    "CommandLine
| endswith": [
      "\\AppData\\Roaming\\MICROS~1\\Windows\\Caches\\NavShExt.dll",
      "\\AppData\\Roaming\\Microsoft\\Windows\\Caches\\NavShExt.dll"
    ]
  },
  "selection_dll_function": {
    "CommandLine
| contains": ",Setting"
  },
  "condition": "process_creation and (1 of selection_other_* or all of selection_dll_*)"
}

False Positives

• ⚠ Unlikely