Detection rules › Elastic
Network Module Loaded from Suspicious Unbacked Memory
Identifies the load of a Windows network module by a process where the creating thread's stack contains frames pointing outside any known executable image. This may indicate evasion via process injection.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth |
Rule body
[rule]
description = """
Identifies the load of a Windows network module by a process where the creating thread's stack contains frames pointing
outside any known executable image. This may indicate evasion via process injection.
"""
id = "aa265fbd-4c57-46ff-9e89-0635101cc50d"
license = "Elastic License v2"
name = "Network Module Loaded from Suspicious Unbacked Memory"
os_list = ["windows"]
reference = [
"https://www.elastic.co/security-labs/pikabot-i-choose-you",
"https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus",
"https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
]
version = "1.0.62"
query = '''
sequence by process.entity_id
[process where event.action == "start" and process.parent.executable != null and
not process.Ext.token.integrity_level_name == "low" and
not user.id in ("S-1-5-19", "S-1-5-20") and
not (process.executable : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*", "?:\\ProgramData\\*", "?:\\Users\\*\\AppData\\*") and
process.code_signature.trusted == true) and
not (process.executable : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*") and process.Ext.relative_file_creation_time >= 80000) and
not process.executable : ("?:\\Windows\\Microsoft.NET\\Framework*\\NGenTask.exe", "?:\\Windows\\Microsoft.NET\\Framework*\\ngen.exe") and
not (process.executable : "?:\\Windows\\Microsoft.NET\\Framework*\\mscorsvw.exe" and
process.parent.executable : "?:\\Windows\\Microsoft.NET\\Framework*\\ngen.exe") and
not (process.executable : "?:\\WINDOWS\\SysWOW64\\DWRCS.EXE" and
process.parent.executable : "?:\\WINDOWS\\SysWOW64\\DWRCS.EXE" and process.parent.args : "-service") and
not (process.executable : "?:\\Windows\\System32\\LogonUI.exe" and
process.parent.executable : "?:\\Windows\\System32\\winlogon.exe") and
not (process.executable : "?:\\Windows\\SysWOW64\\icacls.exe" and
process.args : "?:\\Program Files\\Tenable\\Nessus Agent\\*" and
process.parent.executable : "?:\\Windows\\SysWOW64\\msiexec.exe") and
not (process.name : "rundll32.exe" and
process.command_line : "*zzzzInvokeManagedCustomActionOutOfProc*" and
process.parent.executable : "?:\\Windows\\sys*\\msiexec.exe") and
not (process.name : "rundll32.exe" and process.command_line : "*PcaSvc.dll,PcaPatchSdbTask*" and
user.id == "S-1-5-18" and process.parent.executable : "?:\\Windows\\System32\\svchost.exe") and
not (process.code_signature.subject_name :
("Mozilla Corporation", "Commvault Systems, Inc.", "Google LLC", "YANDEX LLC", "ConnectWise, Inc.",
"Brave Software, Inc.", "Opera Norway AS", "GitHub, Inc.", "Stefan Ries", "JetBrains s.r.o.",
"Intel(R) Rapid Storage Technology", "Waves Inc", "Dell Inc", "Lenovo", "DameWare Development, LLC.",
"Essential Objects, Inc*", "HP Inc.", "Aina Maximit Oy", "Logitech Inc", "N-ABLE TECHNOLOGIES LTD",
"Cognizant TriZetto Software Group, Inc.", "win.acme.simple@gmail.com", "Crownalytics, LLC",
"Kodak Alaris Inc.", "JAM Software GmbH", "UBISOFT ENTERTAINMENT INC.", "DASSAULT SYSTEMES SE",
"Link Data Security A/S", "Western Digital Technologies, Inc.", "Rockstar Games, Inc.",
"SEMPERIS INC.", "Micro-Star International CO., LTD.", "Kaseya Holdings Inc", "KASEYA US LLC",
"Intel(R) Software Development Products", "AAC Infotray AG",
"CORE.AI SCIENTIFIC TECHNOLOGIES PRIVATE LIMITED", "ClaimMaster Software LLC", "Cellebrite DI LTD",
"Riot Games, Inc.", "Autodesk, Inc.", "ACCA software S.p.A.", "Tempus Technologies, Inc.",
"NextgenId, Inc.", "Cloud Software Group, Inc.",
"Bloomberg LP", "GEO NETWORK SRL", "Geo Network - S.R.L.",
"FARO Technologies Inc", "Axis Communications AB", "EWA Technologies, Inc.") and
process.code_signature.trusted == true) and
not (process.pe.original_file_name in~ ("msedge.exe", "msedgewebview2.exe") and
process.code_signature.subject_name like "Microsoft *" and process.code_signature.trusted == true) and
not (process.executable : "?:\\Windows\\System32\\Essentials\\SharedServiceHost.exe" and
process.parent.executable : "?:\\Windows\\System32\\services.exe") and
not (process.name : "powershell.exe" and
process.parent.executable : "?:\\Program Files (x86)\\Lenovo\\VantageService\\*\\LenovoVantage-(LenovoSystemUpdateAddin).exe") and
not process.pe.imphash in ("d41d8cd98f00b204e9800998ecf8427e", "45e4653ae633e067079dd72666b0158b") and
not process.hash.sha256 in
("35542bc04fbfa2e3ef68837640e0459c6f99729c0c73578c08ab351cdf030696",
"1005dcfddfbde91cc967ecc6d778c81cb4f7bede03121a3e6e0d9bae12a033e0",
"53cec44e4fc9a3477d264c5edc9e376af8fcca20853faa289387f5bd7eaae05f",
"49113f4cd7bbf3343a43b13edd745008c4f41da1d80c9f89dc90a4b0bb39b8f8",
"0ab8a14e7fd42818608cc0916fc26a12b2ae6b976c97310dc86011713e455d2d",
"afa3dc1ecd4e15a869dc57a280aee930fc0bab1cd49e17afd3944ae4ad1fc91f",
"18b177280b0e0e05aa0e26807f34634c3384ae4f5901f41ff5bb0a720ea5c106",
"4f1528318085f6117734a27f34a317a83b096d55532000f81ed67b1bb10632fa",
"35f210c1f941f917b81c2516bee9de8f0495baca42095685e9b0b76f67250dc9",
"edef301528767963f460bf7fe497ca3b5c648627a2d13abe74d5544578b56bd4",
"f856a3c582ca689bdea3e784ef6a0db37011bd5ebb31d7c79d0328ebfcf6d8a4",
"fe62ba0a61191a9b54aab7ba3221479c451b042fa30a08957cacff84ddfe094b",
"183cd12fbdd93aa785d3793a8872c4a9730dd154f6482c39f94552e556a7b4e9",
"ed6c844c72fccd7e7799d448f5e74df368cafd2631858573e6e29110c213ac79",
"43a84e01b5ddecf0b6297277d53c72025a73b00b9f0073933a700695a240b5e8",
"f4cb2a001dcee0577046c56df5adfe989bc875c29ecfe27c9569849a9a6f0671",
"ed3730a3436454022e8cf1a27569babef8c9c348ea875f1df80cba9b743365c9",
"51346e95656164783ae4de9d6b202f28be87358eb0e056d2d7cdd12b502d30e7",
"889cb8827a400984bea2e0561a1efbf9d18044e879974da8baa750a0c63748c6",
"96dcdb449ab48b21b6efd33afc59ae163dea5fc597ffaf5dd7030b20d2624467",
"43714f0fc5cea25a6ee936fd36a83f86a45f61447c16c8e9255ef317089ce39c",
"52a5036d1578a6b899fb5d14fd3ab12af463e94ac791d1dddb22b7e8cc1f4bd7",
"f5f15ab19171dbcb58e757cd6446be41e04adf00797d712b07e544066ecd3c67",
"49b95a804337ee7e12092cc7a13c2eb6c3acb33f9bbaac8e820b9184063642f2",
"4c974212f5fc3720d58a8df6c2b9587b85949edc676f9f82921c04f067c261f1",
"ed3730a3436454022e8cf1a27569babef8c9c348ea875f1df80cba9b743365c9",
"121a4e78abe13c92a7ff91d2e91bc98173724072cc891ecbbc10765e8d5bd024",
"54e55d6da825d709cf495eb18be10d8cbb92ac1904c1359999d53d3fa42161e2",
"07e79814fde31ff5968d5c0448014d931cd3a2e59b2ac841bc53a155c333a1b9",
"afcee50eace500b9b2c3dc4faab371fd040d769ba3a5197ef3a8762fe5457337",
"e7883c7d57f5cfe7d1649ab138f62f5042f7acda8ed3c8664c9335c3ddba85c4",
"8982729121fa3b3e6c283437f5832916a5a3611374ac848368c6edaae5086257",
"63f2a4be0dfbaf2b9740aa5c2320d0290451d6d5581cc6f8e183ced9ea796d95",
"30534b04d137543932bc0e66fc778d772ca5d90c0b5faec74a842cad8d50ade8",
"fc0ea005db332feec00e6c34e36de85469d24074c8af23cea84b72eb0fa7fb85",
"cffea8d18419170baded53d75a8d1b8d20170c21ef2d4bebddfb2efcb89a641c",
"ca52dce8cc2aecc23138a524683ad608b4a5eaed9a7a10336e4cf6c7b9d6e5e0",
"b4aa6923bd807af4433c968aa1ded17a3bf8e36f1053fe24dc31dd5a8eb9f4ce",
"4acdfb075f5a801b976819cd22bc3a930ad5f8ee92de2d5ad36b0a4f1e5a8b24",
"1c237e9015c81487aa67d56f8aa4788fbb6bfb3039e455485376712cfc978e62",
"47585eb41299f97c88028c3dae3ba6049355b8e0a8074abeae9f4f9381832c20",
"a26dfec1922d751c710a2f2ab16a33facb6fef8997d21784681f1be637a78b5d",
"be92c45eeb7ffb4b3bf62b76b3218a0c4cdcfa52c8ddb5a47b9abc407dda282e") and
not (process.executable : "?:\\Windows\\SysWOW64\\dllhost.exe" and process.parent.name : "svchost.exe" and
process.Ext.effective_parent.executable : "?:\\Program Files (x86)\\Skillbrains\\lightshot\\*\\Lightshot.exe") and
not (process.executable : ("?:\\Windows\\SysWOW64\\DWRCST.EXE", "?:\\Windows\\SysWOW64\\DWRCS.EXE") and
process.parent.executable : ("?:\\WINDOWS\\SysWOW64\\runonce.exe", "?:\\Windows\\SysWOW64\\DWRCST.EXE", "?:\\Windows\\SysWOW64\\DWRCS.EXE")) and
not (process.executable : "?:\\Windows\\system32\\winsat.exe" and
process.parent.executable : "?:\\Windows\\system32\\rundll32.exe" and
process.parent.args : "sysmain.dll,PfSvWsSwapAssessmentTask") and
not (process.executable : "?:\\Windows\\System32\\inetsrv\\w3wp.exe" and
process.parent.executable : ("?:\\Windows\\System32\\inetsrv\\w3wp.exe", "?:\\Windows\\System32\\svchost.exe")) and
not (process.name : "rundll32.exe" and process.args : "--no-sandbox" and
_arraysearch(process.parent.thread.Ext.call_stack, $entry,
$entry.symbol_info : "?:\\Windows\\assembly\\NativeImages_*\\EO.Base\\*\\EO.Base.ni.dll*")) and
not process.parent.executable : ("?:\\Program Files (x86)\\Advanced Monitoring Agent\\featureres\\PMESetup.exe",
"?:\\PROGRA~2\\ADVANC~1\\featureres\\PMESetup.exe",
"?:\\PROGRA~2\\ADVANC~1\\downloads\\NetworkManagementInstall.exe",
"?:\\PROGRA~2\\ADVANC~1\\staging\\_new_setup.exe",
"?:\\PROGRA~2\\ADVANC~1\\downloads\\MAV-Installer.exe",
"?:\\Program Files (x86)\\LiongardInc\\*\\node.exe",
"C:\\WINDOWS\\_ScriptingFramework\\Modul\\Engine.exe",
"C:\\Program Files\\IperiusRemote\\GlantzSupportClient.exe",
"C:\\Program Files (x86)\\ReluxDesktop\\converter\\Raster2Vector.exe",
"C:\\Program Files (x86)\\Assinador Serpro\\uninstall.exe") and
not (process.executable : "C:\\Windows\\Microsoft.NET\\Framework\\*\\RegAsm.exe" and
process.args : "C:\\Program Files (x86)\\Common Files\\PortsRanch\\WenuMeta\\Micriuuft_Inroles.dll" and
process.parent.executable : "C:\\WINDOWS\\system32\\svchost.exe") and
not process.executable :
("C:\\Program Files (x86)\\MultiExtractor\\MultiExtractor.exe",
"C:\\Program Files (x86)\\Naverisk\\Agent\\Packages\\SoftwareScanPackage\\SoftwareScanner\\Naverisk.Agent.SoftwareScanner.exe") and
not (process.executable : "?:\\APP\\d3\\nats\\NatsCtl.exe" and process.parent.executable : "?:\\APP\\d3\\procmgr\\dserver.exe" and
process.code_signature.trusted == true and process.code_signature.subject_name : "d.velop AG") and
not (process.executable : "*\\PeaxactLicenseServerMonitor.exe" and
process.code_signature.subject_name == "S-PACT GmbH" and
process.code_signature.trusted == true)
]
[library where
dll.name in~ ("ws2_32.dll", "wininet.dll", "winhttp.dll") and
process.thread.Ext.call_stack_contains_unbacked == true and
(
process.thread.Ext.call_stack_summary in
("ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|kernel32.dll|ntdll.dll",
"ntdll.dll|kernelbase.dll|Unbacked",
"ntdll.dll|iphlpapi.dll|Unbacked",
"ntdll.dll|winhttp.dll|Unbacked",
"ntdll.dll|kernelbase.dll|wininet.dll|Unbacked",
"ntdll.dll|kernelbase.dll|Unbacked|kernel32.dll|ntdll.dll",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|Unbacked",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|wininet.dll|Unbacked|ntdll.dll",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|Unbacked|kernel32.dll|ntdll.dll",
"ntdll.dll|kernelbase.dll|Unbacked|kernelbase.dll|ntdll.dll|kernel32.dll|ntdll.dll") or
startswith~(process.thread.Ext.call_stack_summary, concat(concat("ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|", process.name), "|kernel32.dll|ntdll.dll"))
) and
/* DynTrace, HP Sure Click Hook Dll */
not _arraysearch(process.thread.Ext.call_stack, $entry,
$entry.callsite_leading_bytes :
("*6764a118008b40243b835b080000753033c089835b0800008d835f080000508d8353000000506a006a00ff936b080000*",
"45fc33c08945f88bf28dbd82fcffffb9dc000000f3a566a568008000006a0052ff55b86803800000ff55bc8bf080bd82fcffff0074188d8592fdffff50ff55c4",
"*d74533db4c8b4d504c894d284c8d0d0f0000004c894d404c8b4d6041c6410c00ffd0*",
"83ec28488b4c2430ff15b40f00004883c428c3cccccccccccccc4c894424188954241048894c24084883ec38837c244801755f488d0d701f0000ff15720f0000",
"55c0488d55c0488b4d10e8886dadff488bc8488975b8488b55b0488b5220488b02488bd64533db4c8b45b04c8945804c8d050a0000004c894598c6470c00ffd0",
"488bcd48894da8488d8d78ffffff48894b10488975c0488b4db8488b4920488b01488bcf488bd64c8b45b84c8945884c8d050a0000004c8945a0c6430c00ffd0",
"80000000c7858c00000001000000488b4d50488b4920488b01488b8d800000004533db488b555048895528488d150e00000048895540488b5560c6420c00ffd0")) and
/* Managed Code, Cynet MemScanner, xSecuritas */
not _arraysearch(process.thread.Ext.call_stack, $entry,
$entry.callsite_trailing_bytes :
("*8945b4488bcce82c000000908b45b4488b55a8c6420c01488b55a8488b*",
"c6430c01833d*5f007406ff1*",
"48898424e80300004883bc24e803000000750eff94247e030000898424f0030000eb30488d8c2430010000ff94248e03000048898424e80300004883bc24e803",
"8bd885db751eff55c88945f8eb168d8592fdffff50ff55d08bd885db7506ff55c88945f856ff55bc85db0f847601000080bd82fcffff0074508b45fc05a00000",
"488b55a8c6420c01833d8bbeb25f007406ff1593c7b25f8945b4488bcce82c000000908b45b4488b55a8c6420c01488b55a8488b8d70ffffff48894a10488d65",
"**45a848894590eb00488b4590488b5588c6420c01488b5588",
"*488b5560c6420c01488b5560488b4d2048894a",
"c6470c01833d6cf1b45f007406ff15f40cb45f8bf0e8b5e76f5f85f6400f95c6400fb6f64883bdc0000000007423488b8dc0000000e825ebe25e448bc0488b95",
"488b5560c6420c01833db339f55f007406ff153b43f55f898584000000488b4d00e845000000908b8584000000488b5560c6420c01488b5560488b4d2048894a",
"898383080000c7837f080000010000006a0056ff9397080000ff938b*",
"41c64?0c01833d*",
"c6430c0148ba*f87f0000833a00740c*",
"488b8d70ffffffc6410*",
"c6470c01833d*",
"a3b8eb*",
"a314a2e40585c*",
"488b9570ffffffc6420*",
"49bb60c0*",
"488b8d?0ffffffc6410401833d*",
"488b8d?0ffffffc6410401833d*",
"488b5590c6420c01833d*",
"8bf08b45d8c6400801833d801*45e88945dc8b45dc8b55",
"c6470401833de8eee*84883c4785b5e5f415c415d415e415f5dc31910090010e20c300b",
"49bb80b681f6fc7f000048*7f0000ba0c0000004c8d4c2450448d423441ffd3*",
"488b4d88c6410c01*488945a0488b45a0488945a8909090*",
"ebfecc0000*",
"*ba0c0000004c8d4c2450448d423441ffd3*",
"*ca85c0b8000000000fb6d60f95c0898424f40200000ac22b742458d0d80fb6c0*",
"*898424300300008d14922b9c24d0010000f7d28bc3034424600fbbc20facc2183b44240892",
"41c6460c0148ba*7f0000833a00740c*",
"8be55d558bec83ec08c745f800000000*",
"48898424b80000004883bc24b8000000000f848d000000488b442440480510130000488bd0488b8c24b8000000ff94249000000048898424d80000004883bc24",
"898383080000c7837f080000010000006a0056ff9397080000ff938b08000050ff9393080000cc8b1c24c3ce0000087c00960046003a005c00500072006f0067",
"488944242048837c24200075*",
"c6430c01833d*",
"c22800ccccff7424248b0d5c93*",
"a36c3e*985c00f84f9000000568b35*",
"a3b022*985c00f84f9000000568b354c81*",
"48898424b80000004883bc24b8000000000f8498000000488b442440480510130000488bd0488b8c24b8000000ff94249000000048898424d80000004883bc24", "*0000ba0c0000004c8d4c2450448d423441ffd3*",
"41c6470c0148ba*7f0000833a00740c48b9*",
"41c6470c0148ba*4c8b6d8849897508498bc5488b9548ffffff498957104881",
"c6460c01833db6e5e75f007406ff15eae8e65f488bd8e8aa38b25f488bc3488b4d8048894e104883c4785b5e5f415c415d415e415f5dc367611910090010e20c",
"49bb60c05eb7ff7f000048b9*",
"488945984885c07507bac4020000eb2d6685db750*",
"*488b5588498956104883c4785b5e5f415c415d415e",
"c6460c01833d*",
"898383080000c7837f080000010000006a0056ff9397080000*",
"8be55d558bec83ec08c745f800000000c745fc02000000*",
"898383080000c7837f080000010000006a0056ff*",
"49bbb014*f0000ba0c0000004c8d4c2450448d423441ffd349bb403*",
"*00ba0c0000004c8d4c2450448d423441ffd349bb*",
"*48bf7063107ef67f0000488b064889074883c6084883c708488b06488907415f415e415d415c41*",
"1bd1a3300a*f9bc00fa3cab8000000000f98c28d14400f95c00fca0fca8984242403*",
"84c07507e8b8836effeb498b45f88b55c089108b45e48945f4c70518c*",
"488b8d70ffffffc6410c01833df07bca5e007406ff15a47fc95e488b8d70ffffff488b9528ffffff48895110488945b0ff15804ce6fe8945c4488bcce8780000",
"498bd7488bcf4c8be8e819bbffff4533ff4d85ed0f84520200004c8b9760020000488d95e0000000440fb74424744533c9498bcd41ffd24c8be04885c00f8420",
"488943384885c07512ff15035608004c8d054ce80800e93fffffff4c3973407438663b6b1c7511488b5330488bcfff15d65a080085c07421488b4b40ff157857",
"89434885c07507f0ff054b360c000f57c04489bb2c0200004c89bb400200004c89bb480200004489bb500200000f1183580200000f1183680200000f11837802",
"488944242048837c242000750e488d0d7e0f0000e8a1ffffffeb37488d15980f0000488b4c2420ff153d0f0000488944242848837c242800750e488d0d910f00",
"c6430c0148ba446a76e3fd7f0000833a00740c48b9988375e3fd7f0000ff11488b5580488953104883c4785b5e5f415c415d415e415f5dc30000001910090010",
"f7d20fca85c08af3a37002f103b8000000000fca0f95c01af08984243803000033b424e001000003c60fc8e9a50100004a8bc6c1ea0b8d94248c01000003023b",
"488945984885c07507bac4020000eb2d6685db7505bbffff00000fb7d3488bc8448bca89542420448bc2488d058dc00000ff140785c0752cbad0020000488b8d",
"807c240c00894604740d85c0740583f8ff7504c64608008bc65ec20800568bf18b4e0433c085c9741083f9ff740bff74240851ff1598412f03807c240c007407",
"488906488bcb41ff542420488b064903e6eb17488bcb41ff5424384883f8087e06488b46f8eb034833c04883c420415e415c5f5e5bc300000000000000000000",
"48898424f00300004883bc24f003000000750eff94248e030000898424f80300008b8c24fc030000ff942476030000eb30488d8c2440010000ff94249e030000",
"8945f8837df80074658b45fc05601a0000508b4df8518b55fc8b8250170000ffd08945f4837df4007426b9010000006bd1008b45fc0fbe8c10641b000085c974",
"c6430c0148ba446a8e00f87f0000833a00740c48b998838d00f87f0000ff11488b5580488953104883c4785b5e5f415c415d415e415f5dc30000001910090010",
"48890550cf4700483bc30f849e010000488d15f0ab3800488bc8ff15a7173600488b0d30cf4700488d15c1ab380048890532cf4700ff158c173600488b0d15cf",
"4889842470020000488d0d1e5e1100ff15c0fc10004889442458488d0dfc5d1100ff15aefc100048898424a0020000488d15cf5d1100488b4c2458ff159cfc10",
"488944242048837c242000750e488d0d7e0f0000e8a1ffffffeb37488d15980f0000488b4c2420ff153d0f0000488944242848837c242800750e488d0d910f00",
"4885c0750bb8030000004883c4205bc3488d9318020000488bc8ff53084885c0750bb8040000004883c4205bc3488b4b10ffd033c04883c4205bc3cccccccccc",
"488944242048837c242000750e488d0d7e0f0000e8a1ffffffeb37488d15980f0000488b4c2420ff153d0f0000488944242848837c242800750e488d0d910f00",
"488b8d70ffffffc6410c01833d1479e65d007406ff1524cde55d488b8d70ffffff488b9528ffffff48895110488945b0ff1558ca1cfe8945c4488bcce8780000",
"4c8bd04889442458488d05345d00004803c6488d4c2458ffd084c07407bac3020000eb2d6685db7505bb102700000fb7d3488d053fbd0000448bca8954242044",
"86f285c00f94c28b9424c0020000a3302858048bc2b8000000000f90c00fa3d00f95c03ae084f48984245c0300000f94c4c0dc022b9c24bc0100008d049b0fa4",
"86f285c00f94c28b9424c0020000a33028*",
"49bbb01432c7fd7f000048b9*f0000ba0c0000004c8d4c2450448d423441ffd349bb403ed1c9fd7f*",
"488b4d98c6410c01833d*488b4d98488b9558ffffff4889511*",
"488944242848837c242800750bff9424be03000089442430eb27488d8c2470010000ff9424ce030000488944242848837c242800750bff9424be030000894424",
"4c8bf04885c00f84cc00000083fb027c22488d4c2458c74424585b57485dc744245c2047504166c74424600a00ff9570010000488d542468498bceff55384c8b",
"488bc84885c075098d41034883c4205bc3488b4308488d9318020000ffd04885c0750bb8040000004883c4205bc3488b4b10ffd033c04883c4205bc3cccc488b",
"48be84*7f0000488b064889074883c6084883c708488b06488907415f415e415d415c415b415a415941585f5e5d5c5b5*",
"488d15d1832000488bc8ff1590651700488905a1a7280048833d99a72800000f84ab000000488d1524010000488d0d85a72800e8483a120085c0754be87f79f1",
"8bd8488d8d28ffffffff159fb9010083fb6f0f85d00100008b4db8ff154dbf0100488945b0488d55b848895580488b4db048894d88488d8d28ffffffff1564b9",
"8bf8689c2*02ffd689458068902*",
"8bf86*ffd689458068*",
"5356578965e880*6a015b0f85f502000088*",
"8945a88b7b0c037ddc8bf7ac84c07*",
"8bf08b45d8c6400801833d8011*8945ec33c9894de08b4dece*",
"c0d60285c086d6a39000*c1ea1bf6d28bc30fb6d22b8424e00100004a8ad3",
"411bd5a3900*fbec375218ae0fec6039c24a0010000f7dac784",
"c6470401833de*48894f084883c4785b5e5f415c415d415e415f5dc31910090010e20c300b",
"89854d294400c78551294400000000008b95d83044008b0685c075038b461003c20385512944008b188b7e1003fa03bd5129440085db0f84a2000000f7c30000",
"c22800cccccccccccc8b4424148b5424108b0d08a92d05508b442410528b542410508b44241081c1ac080000528b11508b4224ffd0ffd0c21400cccccccccccc",
"488944242848837c242800750bff9424ae03000089442430eb27488d8c2460010000ff9424be030000488944242848837c242800750bff9424ae030000894424",
"a36c3e*85c00f84f9000000568b3548*",
"8bd885db0f8440020000895e148d45c08b0d1c16*",
"898307100000c78303100000010000006a0056ff9313280000ff930728000050ff930f280000cc8b1c24c38da424000000008da424000000008da42400000000",
"488905fc764c00483bc30f84a5010000488d1504803d00488bc8ff1593253b00488b0ddc764c00488d15d57f3d00488905de764c00ff1578253b00488b0dc176",
"898307100000c78303100000010000006a0056ff9313280000ff930728000050ff930f280000cc8b1c24c38da424000000008da424000000008da42400000000"))]
until [process where event.action == "end"]
'''
min_endpoint_version = "8.8.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "8.8.0"
Stages and Predicates
Ordered sequence: each step below must occur in order, correlated by process.entity_id.
Stage 1: process
[process where event.action == "start" and process.parent.executable != null and
not process.Ext.token.integrity_level_name == "low" and
not user.id in ("S-1-5-19", "S-1-5-20") and
not (process.executable : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*", "?:\\ProgramData\\*", "?:\\Users\\*\\AppData\\*") and
process.code_signature.trusted == true) and
not (process.executable : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*") and process.Ext.relative_file_creation_time >= 80000) and
not process.executable : ("?:\\Windows\\Microsoft.NET\\Framework*\\NGenTask.exe", "?:\\Windows\\Microsoft.NET\\Framework*\\ngen.exe") and
not (process.executable : "?:\\Windows\\Microsoft.NET\\Framework*\\mscorsvw.exe" and
process.parent.executable : "?:\\Windows\\Microsoft.NET\\Framework*\\ngen.exe") and
not (process.executable : "?:\\WINDOWS\\SysWOW64\\DWRCS.EXE" and
process.parent.executable : "?:\\WINDOWS\\SysWOW64\\DWRCS.EXE" and process.parent.args : "-service") and
not (process.executable : "?:\\Windows\\System32\\LogonUI.exe" and
process.parent.executable : "?:\\Windows\\System32\\winlogon.exe") and
not (process.executable : "?:\\Windows\\SysWOW64\\icacls.exe" and
process.args : "?:\\Program Files\\Tenable\\Nessus Agent\\*" and
process.parent.executable : "?:\\Windows\\SysWOW64\\msiexec.exe") and
not (process.name : "rundll32.exe" and
process.command_line : "*zzzzInvokeManagedCustomActionOutOfProc*" and
process.parent.executable : "?:\\Windows\\sys*\\msiexec.exe") and
not (process.name : "rundll32.exe" and process.command_line : "*PcaSvc.dll,PcaPatchSdbTask*" and
user.id == "S-1-5-18" and process.parent.executable : "?:\\Windows\\System32\\svchost.exe") and
not (process.code_signature.subject_name :
("Mozilla Corporation", "Commvault Systems, Inc.", "Google LLC", "YANDEX LLC", "ConnectWise, Inc.",
"Brave Software, Inc.", "Opera Norway AS", "GitHub, Inc.", "Stefan Ries", "JetBrains s.r.o.",
"Intel(R) Rapid Storage Technology", "Waves Inc", "Dell Inc", "Lenovo", "DameWare Development, LLC.",
"Essential Objects, Inc*", "HP Inc.", "Aina Maximit Oy", "Logitech Inc", "N-ABLE TECHNOLOGIES LTD",
"Cognizant TriZetto Software Group, Inc.", "win.acme.simple@gmail.com", "Crownalytics, LLC",
"Kodak Alaris Inc.", "JAM Software GmbH", "UBISOFT ENTERTAINMENT INC.", "DASSAULT SYSTEMES SE",
"Link Data Security A/S", "Western Digital Technologies, Inc.", "Rockstar Games, Inc.",
"SEMPERIS INC.", "Micro-Star International CO., LTD.", "Kaseya Holdings Inc", "KASEYA US LLC",
"Intel(R) Software Development Products", "AAC Infotray AG",
"CORE.AI SCIENTIFIC TECHNOLOGIES PRIVATE LIMITED", "ClaimMaster Software LLC", "Cellebrite DI LTD",
"Riot Games, Inc.", "Autodesk, Inc.", "ACCA software S.p.A.", "Tempus Technologies, Inc.",
"NextgenId, Inc.", "Cloud Software Group, Inc.",
"Bloomberg LP", "GEO NETWORK SRL", "Geo Network - S.R.L.",
"FARO Technologies Inc", "Axis Communications AB", "EWA Technologies, Inc.") and
process.code_signature.trusted == true) and
not (process.pe.original_file_name in~ ("msedge.exe", "msedgewebview2.exe") and
process.code_signature.subject_name like "Microsoft *" and process.code_signature.trusted == true) and
not (process.executable : "?:\\Windows\\System32\\Essentials\\SharedServiceHost.exe" and
process.parent.executable : "?:\\Windows\\System32\\services.exe") and
not (process.name : "powershell.exe" and
process.parent.executable : "?:\\Program Files (x86)\\Lenovo\\VantageService\\*\\LenovoVantage-(LenovoSystemUpdateAddin).exe") and
not process.pe.imphash in ("d41d8cd98f00b204e9800998ecf8427e", "45e4653ae633e067079dd72666b0158b") and
not process.hash.sha256 in
("35542bc04fbfa2e3ef68837640e0459c6f99729c0c73578c08ab351cdf030696",
"1005dcfddfbde91cc967ecc6d778c81cb4f7bede03121a3e6e0d9bae12a033e0",
"53cec44e4fc9a3477d264c5edc9e376af8fcca20853faa289387f5bd7eaae05f",
"49113f4cd7bbf3343a43b13edd745008c4f41da1d80c9f89dc90a4b0bb39b8f8",
"0ab8a14e7fd42818608cc0916fc26a12b2ae6b976c97310dc86011713e455d2d",
"afa3dc1ecd4e15a869dc57a280aee930fc0bab1cd49e17afd3944ae4ad1fc91f",
"18b177280b0e0e05aa0e26807f34634c3384ae4f5901f41ff5bb0a720ea5c106",
"4f1528318085f6117734a27f34a317a83b096d55532000f81ed67b1bb10632fa",
"35f210c1f941f917b81c2516bee9de8f0495baca42095685e9b0b76f67250dc9",
"edef301528767963f460bf7fe497ca3b5c648627a2d13abe74d5544578b56bd4",
"f856a3c582ca689bdea3e784ef6a0db37011bd5ebb31d7c79d0328ebfcf6d8a4",
"fe62ba0a61191a9b54aab7ba3221479c451b042fa30a08957cacff84ddfe094b",
"183cd12fbdd93aa785d3793a8872c4a9730dd154f6482c39f94552e556a7b4e9",
"ed6c844c72fccd7e7799d448f5e74df368cafd2631858573e6e29110c213ac79",
"43a84e01b5ddecf0b6297277d53c72025a73b00b9f0073933a700695a240b5e8",
"f4cb2a001dcee0577046c56df5adfe989bc875c29ecfe27c9569849a9a6f0671",
"ed3730a3436454022e8cf1a27569babef8c9c348ea875f1df80cba9b743365c9",
"51346e95656164783ae4de9d6b202f28be87358eb0e056d2d7cdd12b502d30e7",
"889cb8827a400984bea2e0561a1efbf9d18044e879974da8baa750a0c63748c6",
"96dcdb449ab48b21b6efd33afc59ae163dea5fc597ffaf5dd7030b20d2624467",
"43714f0fc5cea25a6ee936fd36a83f86a45f61447c16c8e9255ef317089ce39c",
"52a5036d1578a6b899fb5d14fd3ab12af463e94ac791d1dddb22b7e8cc1f4bd7",
"f5f15ab19171dbcb58e757cd6446be41e04adf00797d712b07e544066ecd3c67",
"49b95a804337ee7e12092cc7a13c2eb6c3acb33f9bbaac8e820b9184063642f2",
"4c974212f5fc3720d58a8df6c2b9587b85949edc676f9f82921c04f067c261f1",
"ed3730a3436454022e8cf1a27569babef8c9c348ea875f1df80cba9b743365c9",
"121a4e78abe13c92a7ff91d2e91bc98173724072cc891ecbbc10765e8d5bd024",
"54e55d6da825d709cf495eb18be10d8cbb92ac1904c1359999d53d3fa42161e2",
"07e79814fde31ff5968d5c0448014d931cd3a2e59b2ac841bc53a155c333a1b9",
"afcee50eace500b9b2c3dc4faab371fd040d769ba3a5197ef3a8762fe5457337",
"e7883c7d57f5cfe7d1649ab138f62f5042f7acda8ed3c8664c9335c3ddba85c4",
"8982729121fa3b3e6c283437f5832916a5a3611374ac848368c6edaae5086257",
"63f2a4be0dfbaf2b9740aa5c2320d0290451d6d5581cc6f8e183ced9ea796d95",
"30534b04d137543932bc0e66fc778d772ca5d90c0b5faec74a842cad8d50ade8",
"fc0ea005db332feec00e6c34e36de85469d24074c8af23cea84b72eb0fa7fb85",
"cffea8d18419170baded53d75a8d1b8d20170c21ef2d4bebddfb2efcb89a641c",
"ca52dce8cc2aecc23138a524683ad608b4a5eaed9a7a10336e4cf6c7b9d6e5e0",
"b4aa6923bd807af4433c968aa1ded17a3bf8e36f1053fe24dc31dd5a8eb9f4ce",
"4acdfb075f5a801b976819cd22bc3a930ad5f8ee92de2d5ad36b0a4f1e5a8b24",
"1c237e9015c81487aa67d56f8aa4788fbb6bfb3039e455485376712cfc978e62",
"47585eb41299f97c88028c3dae3ba6049355b8e0a8074abeae9f4f9381832c20",
"a26dfec1922d751c710a2f2ab16a33facb6fef8997d21784681f1be637a78b5d",
"be92c45eeb7ffb4b3bf62b76b3218a0c4cdcfa52c8ddb5a47b9abc407dda282e") and
not (process.executable : "?:\\Windows\\SysWOW64\\dllhost.exe" and process.parent.name : "svchost.exe" and
process.Ext.effective_parent.executable : "?:\\Program Files (x86)\\Skillbrains\\lightshot\\*\\Lightshot.exe") and
not (process.executable : ("?:\\Windows\\SysWOW64\\DWRCST.EXE", "?:\\Windows\\SysWOW64\\DWRCS.EXE") and
process.parent.executable : ("?:\\WINDOWS\\SysWOW64\\runonce.exe", "?:\\Windows\\SysWOW64\\DWRCST.EXE", "?:\\Windows\\SysWOW64\\DWRCS.EXE")) and
not (process.executable : "?:\\Windows\\system32\\winsat.exe" and
process.parent.executable : "?:\\Windows\\system32\\rundll32.exe" and
process.parent.args : "sysmain.dll,PfSvWsSwapAssessmentTask") and
not (process.executable : "?:\\Windows\\System32\\inetsrv\\w3wp.exe" and
process.parent.executable : ("?:\\Windows\\System32\\inetsrv\\w3wp.exe", "?:\\Windows\\System32\\svchost.exe")) and
not (process.name : "rundll32.exe" and process.args : "--no-sandbox" and
_arraysearch(process.parent.thread.Ext.call_stack, $entry,
$entry.symbol_info : "?:\\Windows\\assembly\\NativeImages_*\\EO.Base\\*\\EO.Base.ni.dll*")) and
not process.parent.executable : ("?:\\Program Files (x86)\\Advanced Monitoring Agent\\featureres\\PMESetup.exe",
"?:\\PROGRA~2\\ADVANC~1\\featureres\\PMESetup.exe",
"?:\\PROGRA~2\\ADVANC~1\\downloads\\NetworkManagementInstall.exe",
"?:\\PROGRA~2\\ADVANC~1\\staging\\_new_setup.exe",
"?:\\PROGRA~2\\ADVANC~1\\downloads\\MAV-Installer.exe",
"?:\\Program Files (x86)\\LiongardInc\\*\\node.exe",
"C:\\WINDOWS\\_ScriptingFramework\\Modul\\Engine.exe",
"C:\\Program Files\\IperiusRemote\\GlantzSupportClient.exe",
"C:\\Program Files (x86)\\ReluxDesktop\\converter\\Raster2Vector.exe",
"C:\\Program Files (x86)\\Assinador Serpro\\uninstall.exe") and
not (process.executable : "C:\\Windows\\Microsoft.NET\\Framework\\*\\RegAsm.exe" and
process.args : "C:\\Program Files (x86)\\Common Files\\PortsRanch\\WenuMeta\\Micriuuft_Inroles.dll" and
process.parent.executable : "C:\\WINDOWS\\system32\\svchost.exe") and
not process.executable :
("C:\\Program Files (x86)\\MultiExtractor\\MultiExtractor.exe",
"C:\\Program Files (x86)\\Naverisk\\Agent\\Packages\\SoftwareScanPackage\\SoftwareScanner\\Naverisk.Agent.SoftwareScanner.exe") and
not (process.executable : "?:\\APP\\d3\\nats\\NatsCtl.exe" and process.parent.executable : "?:\\APP\\d3\\procmgr\\dserver.exe" and
process.code_signature.trusted == true and process.code_signature.subject_name : "d.velop AG") and
not (process.executable : "*\\PeaxactLicenseServerMonitor.exe" and
process.code_signature.subject_name == "S-PACT GmbH" and
process.code_signature.trusted == true)
]
Stage 2: library
[library where
dll.name in~ ("ws2_32.dll", "wininet.dll", "winhttp.dll") and
process.thread.Ext.call_stack_contains_unbacked == true and
(
process.thread.Ext.call_stack_summary in
("ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|kernel32.dll|ntdll.dll",
"ntdll.dll|kernelbase.dll|Unbacked",
"ntdll.dll|iphlpapi.dll|Unbacked",
"ntdll.dll|winhttp.dll|Unbacked",
"ntdll.dll|kernelbase.dll|wininet.dll|Unbacked",
"ntdll.dll|kernelbase.dll|Unbacked|kernel32.dll|ntdll.dll",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|Unbacked",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|wininet.dll|Unbacked|ntdll.dll",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|Unbacked|kernel32.dll|ntdll.dll",
"ntdll.dll|kernelbase.dll|Unbacked|kernelbase.dll|ntdll.dll|kernel32.dll|ntdll.dll") or
startswith~(process.thread.Ext.call_stack_summary, concat(concat("ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|", process.name), "|kernel32.dll|ntdll.dll"))
) and
not _arraysearch(process.thread.Ext.call_stack, $entry,
$entry.callsite_leading_bytes :
("*6764a118008b40243b835b080000753033c089835b0800008d835f080000508d8353000000506a006a00ff936b080000*",
"45fc33c08945f88bf28dbd82fcffffb9dc000000f3a566a568008000006a0052ff55b86803800000ff55bc8bf080bd82fcffff0074188d8592fdffff50ff55c4",
"*d74533db4c8b4d504c894d284c8d0d0f0000004c894d404c8b4d6041c6410c00ffd0*",
"83ec28488b4c2430ff15b40f00004883c428c3cccccccccccccc4c894424188954241048894c24084883ec38837c244801755f488d0d701f0000ff15720f0000",
"55c0488d55c0488b4d10e8886dadff488bc8488975b8488b55b0488b5220488b02488bd64533db4c8b45b04c8945804c8d050a0000004c894598c6470c00ffd0",
"488bcd48894da8488d8d78ffffff48894b10488975c0488b4db8488b4920488b01488bcf488bd64c8b45b84c8945884c8d050a0000004c8945a0c6430c00ffd0",
"80000000c7858c00000001000000488b4d50488b4920488b01488b8d800000004533db488b555048895528488d150e00000048895540488b5560c6420c00ffd0")) and
not _arraysearch(process.thread.Ext.call_stack, $entry,
$entry.callsite_trailing_bytes :
("*8945b4488bcce82c000000908b45b4488b55a8c6420c01488b55a8488b*",
"c6430c01833d*5f007406ff1*",
"48898424e80300004883bc24e803000000750eff94247e030000898424f0030000eb30488d8c2430010000ff94248e03000048898424e80300004883bc24e803",
"8bd885db751eff55c88945f8eb168d8592fdffff50ff55d08bd885db7506ff55c88945f856ff55bc85db0f847601000080bd82fcffff0074508b45fc05a00000",
"488b55a8c6420c01833d8bbeb25f007406ff1593c7b25f8945b4488bcce82c000000908b45b4488b55a8c6420c01488b55a8488b8d70ffffff48894a10488d65",
"**45a848894590eb00488b4590488b5588c6420c01488b5588",
"*488b5560c6420c01488b5560488b4d2048894a",
"c6470c01833d6cf1b45f007406ff15f40cb45f8bf0e8b5e76f5f85f6400f95c6400fb6f64883bdc0000000007423488b8dc0000000e825ebe25e448bc0488b95",
"488b5560c6420c01833db339f55f007406ff153b43f55f898584000000488b4d00e845000000908b8584000000488b5560c6420c01488b5560488b4d2048894a",
"898383080000c7837f080000010000006a0056ff9397080000ff938b*",
"41c64?0c01833d*",
"c6430c0148ba*f87f0000833a00740c*",
"488b8d70ffffffc6410*",
"c6470c01833d*",
"a3b8eb*",
"a314a2e40585c*",
"488b9570ffffffc6420*",
"49bb60c0*",
"488b8d?0ffffffc6410401833d*",
"488b8d?0ffffffc6410401833d*",
"488b5590c6420c01833d*",
"8bf08b45d8c6400801833d801*45e88945dc8b45dc8b55",
"c6470401833de8eee*84883c4785b5e5f415c415d415e415f5dc31910090010e20c300b",
"49bb80b681f6fc7f000048*7f0000ba0c0000004c8d4c2450448d423441ffd3*",
"488b4d88c6410c01*488945a0488b45a0488945a8909090*",
"ebfecc0000*",
"*ba0c0000004c8d4c2450448d423441ffd3*",
"*ca85c0b8000000000fb6d60f95c0898424f40200000ac22b742458d0d80fb6c0*",
"*898424300300008d14922b9c24d0010000f7d28bc3034424600fbbc20facc2183b44240892",
"41c6460c0148ba*7f0000833a00740c*",
"8be55d558bec83ec08c745f800000000*",
"48898424b80000004883bc24b8000000000f848d000000488b442440480510130000488bd0488b8c24b8000000ff94249000000048898424d80000004883bc24",
"898383080000c7837f080000010000006a0056ff9397080000ff938b08000050ff9393080000cc8b1c24c3ce0000087c00960046003a005c00500072006f0067",
"488944242048837c24200075*",
"c6430c01833d*",
"c22800ccccff7424248b0d5c93*",
"a36c3e*985c00f84f9000000568b35*",
"a3b022*985c00f84f9000000568b354c81*",
"48898424b80000004883bc24b8000000000f8498000000488b442440480510130000488bd0488b8c24b8000000ff94249000000048898424d80000004883bc24", "*0000ba0c0000004c8d4c2450448d423441ffd3*",
"41c6470c0148ba*7f0000833a00740c48b9*",
"41c6470c0148ba*4c8b6d8849897508498bc5488b9548ffffff498957104881",
"c6460c01833db6e5e75f007406ff15eae8e65f488bd8e8aa38b25f488bc3488b4d8048894e104883c4785b5e5f415c415d415e415f5dc367611910090010e20c",
"49bb60c05eb7ff7f000048b9*",
"488945984885c07507bac4020000eb2d6685db750*",
"*488b5588498956104883c4785b5e5f415c415d415e",
"c6460c01833d*",
"898383080000c7837f080000010000006a0056ff9397080000*",
"8be55d558bec83ec08c745f800000000c745fc02000000*",
"898383080000c7837f080000010000006a0056ff*",
"49bbb014*f0000ba0c0000004c8d4c2450448d423441ffd349bb403*",
"*00ba0c0000004c8d4c2450448d423441ffd349bb*",
"*48bf7063107ef67f0000488b064889074883c6084883c708488b06488907415f415e415d415c41*",
"1bd1a3300a*f9bc00fa3cab8000000000f98c28d14400f95c00fca0fca8984242403*",
"84c07507e8b8836effeb498b45f88b55c089108b45e48945f4c70518c*",
"488b8d70ffffffc6410c01833df07bca5e007406ff15a47fc95e488b8d70ffffff488b9528ffffff48895110488945b0ff15804ce6fe8945c4488bcce8780000",
"498bd7488bcf4c8be8e819bbffff4533ff4d85ed0f84520200004c8b9760020000488d95e0000000440fb74424744533c9498bcd41ffd24c8be04885c00f8420",
"488943384885c07512ff15035608004c8d054ce80800e93fffffff4c3973407438663b6b1c7511488b5330488bcfff15d65a080085c07421488b4b40ff157857",
"89434885c07507f0ff054b360c000f57c04489bb2c0200004c89bb400200004c89bb480200004489bb500200000f1183580200000f1183680200000f11837802",
"488944242048837c242000750e488d0d7e0f0000e8a1ffffffeb37488d15980f0000488b4c2420ff153d0f0000488944242848837c242800750e488d0d910f00",
"c6430c0148ba446a76e3fd7f0000833a00740c48b9988375e3fd7f0000ff11488b5580488953104883c4785b5e5f415c415d415e415f5dc30000001910090010",
"f7d20fca85c08af3a37002f103b8000000000fca0f95c01af08984243803000033b424e001000003c60fc8e9a50100004a8bc6c1ea0b8d94248c01000003023b",
"488945984885c07507bac4020000eb2d6685db7505bbffff00000fb7d3488bc8448bca89542420448bc2488d058dc00000ff140785c0752cbad0020000488b8d",
"807c240c00894604740d85c0740583f8ff7504c64608008bc65ec20800568bf18b4e0433c085c9741083f9ff740bff74240851ff1598412f03807c240c007407",
"488906488bcb41ff542420488b064903e6eb17488bcb41ff5424384883f8087e06488b46f8eb034833c04883c420415e415c5f5e5bc300000000000000000000",
"48898424f00300004883bc24f003000000750eff94248e030000898424f80300008b8c24fc030000ff942476030000eb30488d8c2440010000ff94249e030000",
"8945f8837df80074658b45fc05601a0000508b4df8518b55fc8b8250170000ffd08945f4837df4007426b9010000006bd1008b45fc0fbe8c10641b000085c974",
"c6430c0148ba446a8e00f87f0000833a00740c48b998838d00f87f0000ff11488b5580488953104883c4785b5e5f415c415d415e415f5dc30000001910090010",
"48890550cf4700483bc30f849e010000488d15f0ab3800488bc8ff15a7173600488b0d30cf4700488d15c1ab380048890532cf4700ff158c173600488b0d15cf",
"4889842470020000488d0d1e5e1100ff15c0fc10004889442458488d0dfc5d1100ff15aefc100048898424a0020000488d15cf5d1100488b4c2458ff159cfc10",
"488944242048837c242000750e488d0d7e0f0000e8a1ffffffeb37488d15980f0000488b4c2420ff153d0f0000488944242848837c242800750e488d0d910f00",
"4885c0750bb8030000004883c4205bc3488d9318020000488bc8ff53084885c0750bb8040000004883c4205bc3488b4b10ffd033c04883c4205bc3cccccccccc",
"488944242048837c242000750e488d0d7e0f0000e8a1ffffffeb37488d15980f0000488b4c2420ff153d0f0000488944242848837c242800750e488d0d910f00",
"488b8d70ffffffc6410c01833d1479e65d007406ff1524cde55d488b8d70ffffff488b9528ffffff48895110488945b0ff1558ca1cfe8945c4488bcce8780000",
"4c8bd04889442458488d05345d00004803c6488d4c2458ffd084c07407bac3020000eb2d6685db7505bb102700000fb7d3488d053fbd0000448bca8954242044",
"86f285c00f94c28b9424c0020000a3302858048bc2b8000000000f90c00fa3d00f95c03ae084f48984245c0300000f94c4c0dc022b9c24bc0100008d049b0fa4",
"86f285c00f94c28b9424c0020000a33028*",
"49bbb01432c7fd7f000048b9*f0000ba0c0000004c8d4c2450448d423441ffd349bb403ed1c9fd7f*",
"488b4d98c6410c01833d*488b4d98488b9558ffffff4889511*",
"488944242848837c242800750bff9424be03000089442430eb27488d8c2470010000ff9424ce030000488944242848837c242800750bff9424be030000894424",
"4c8bf04885c00f84cc00000083fb027c22488d4c2458c74424585b57485dc744245c2047504166c74424600a00ff9570010000488d542468498bceff55384c8b",
"488bc84885c075098d41034883c4205bc3488b4308488d9318020000ffd04885c0750bb8040000004883c4205bc3488b4b10ffd033c04883c4205bc3cccc488b",
"48be84*7f0000488b064889074883c6084883c708488b06488907415f415e415d415c415b415a415941585f5e5d5c5b5*",
"488d15d1832000488bc8ff1590651700488905a1a7280048833d99a72800000f84ab000000488d1524010000488d0d85a72800e8483a120085c0754be87f79f1",
"8bd8488d8d28ffffffff159fb9010083fb6f0f85d00100008b4db8ff154dbf0100488945b0488d55b848895580488b4db048894d88488d8d28ffffffff1564b9",
"8bf8689c2*02ffd689458068902*",
"8bf86*ffd689458068*",
"5356578965e880*6a015b0f85f502000088*",
"8945a88b7b0c037ddc8bf7ac84c07*",
"8bf08b45d8c6400801833d8011*8945ec33c9894de08b4dece*",
"c0d60285c086d6a39000*c1ea1bf6d28bc30fb6d22b8424e00100004a8ad3",
"411bd5a3900*fbec375218ae0fec6039c24a0010000f7dac784",
"c6470401833de*48894f084883c4785b5e5f415c415d415e415f5dc31910090010e20c300b",
"89854d294400c78551294400000000008b95d83044008b0685c075038b461003c20385512944008b188b7e1003fa03bd5129440085db0f84a2000000f7c30000",
"c22800cccccccccccc8b4424148b5424108b0d08a92d05508b442410528b542410508b44241081c1ac080000528b11508b4224ffd0ffd0c21400cccccccccccc",
"488944242848837c242800750bff9424ae03000089442430eb27488d8c2460010000ff9424be030000488944242848837c242800750bff9424ae030000894424",
"a36c3e*85c00f84f9000000568b3548*",
"8bd885db0f8440020000895e148d45c08b0d1c16*",
"898307100000c78303100000010000006a0056ff9313280000ff930728000050ff930f280000cc8b1c24c38da424000000008da424000000008da42400000000",
"488905fc764c00483bc30f84a5010000488d1504803d00488bc8ff1593253b00488b0ddc764c00488d15d57f3d00488905de764c00ff1578253b00488b0dc176",
"898307100000c78303100000010000006a0056ff9313280000ff930728000050ff930f280000cc8b1c24c38da424000000008da424000000008da42400000000"))]
Until: process
until [process where event.action == "end"]
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
process.parent.thread.Ext.call_stack | array_any | excludes:process.parent.thread.Ext.call_stack | |
process.args | eq | --no-sandbox | excludes:process.args field:"process.args" value:"--no-sandbox" |
process.name | eq | rundll32.exe | excludes:process.name field:"process.name" value:"rundll32.exe" |
process.Ext.effective_parent.executable | wildcard | ?:\Program Files (x86)\Skillbrains\lightshot\*\Lightshot.exe | excludes:process.Ext.effective_parent.executable field:"process.Ext.effective_parent.executable" value:"?:\Program Files (x86)\Skillbrains\lightshot\*\Lightshot.exe" |
process.executable | eq | ?:\Windows\SysWOW64\dllhost.exe | excludes:process.executable field:"process.executable" value:"?:\Windows\SysWOW64\dllhost.exe" |
process.parent.name | eq | svchost.exe | excludes:process.parent.name field:"process.parent.name" value:"svchost.exe" |
process.Ext.relative_file_creation_time | ge | 80000 | excludes:process.Ext.relative_file_creation_time field:"process.Ext.relative_file_creation_time" value:"80000" |
process.executable | starts_with | ?:\Program Files (x86)\, ?:\Program Files\ | excludes:process.executable field:"process.executable" value:"?:\Program Files (x86)\" field:"process.executable" value:"?:\Program Files\" |
process.args | eq | C:\Program Files (x86)\Common Files\PortsRanch\WenuMeta\Micriuuft_Inroles.dll | excludes:process.args field:"process.args" value:"C:\Program Files (x86)\Common Files\PortsRanch\WenuMeta\Micriuuft_Inroles.dll" |
process.executable | wildcard | C:\Windows\Microsoft.NET\Framework\*\RegAsm.exe | excludes:process.executable field:"process.executable" value:"C:\Windows\Microsoft.NET\Framework\*\RegAsm.exe" |
process.parent.executable | eq | C:\WINDOWS\system32\svchost.exe | excludes:process.parent.executable field:"process.parent.executable" value:"C:\WINDOWS\system32\svchost.exe" |
process.args | starts_with | ?:\Program Files\Tenable\Nessus Agent\ | excludes:process.args field:"process.args" value:"?:\Program Files\Tenable\Nessus Agent\" |
process.executable | eq | ?:\Windows\SysWOW64\icacls.exe | excludes:process.executable field:"process.executable" value:"?:\Windows\SysWOW64\icacls.exe" |
process.parent.executable | eq | ?:\Windows\SysWOW64\msiexec.exe | excludes:process.parent.executable field:"process.parent.executable" value:"?:\Windows\SysWOW64\msiexec.exe" |
process.code_signature.subject_name | eq | S-PACT GmbH | excludes:process.code_signature.subject_name field:"process.code_signature.subject_name" value:"S-PACT GmbH" |
process.code_signature.trusted | eq | true | excludes:process.code_signature.trusted field:"process.code_signature.trusted" value:"true" |
process.executable | ends_with | \PeaxactLicenseServerMonitor.exe | excludes:process.executable field:"process.executable" value:"\PeaxactLicenseServerMonitor.exe" |
process.code_signature.subject_name | eq | d.velop AG | excludes:process.code_signature.subject_name field:"process.code_signature.subject_name" value:"d.velop AG" |
process.executable | eq | ?:\APP\d3\nats\NatsCtl.exe | excludes:process.executable field:"process.executable" value:"?:\APP\d3\nats\NatsCtl.exe" |
process.parent.executable | eq | ?:\APP\d3\procmgr\dserver.exe | excludes:process.parent.executable field:"process.parent.executable" value:"?:\APP\d3\procmgr\dserver.exe" |
process.code_signature.subject_name | starts_with | Microsoft | excludes:process.code_signature.subject_name field:"process.code_signature.subject_name" value:"Microsoft " |
process.pe.original_file_name | in | msedge.exe, msedgewebview2.exe | excludes:process.pe.original_file_name field:"process.pe.original_file_name" value:"msedge.exe" field:"process.pe.original_file_name" value:"msedgewebview2.exe" |
process.code_signature.subject_name | wildcard | Mozilla Corporation, Commvault Systems, Inc., Google LLC, YANDEX LLC, ConnectWise, Inc., Brave Software, Inc., Opera Norway AS, GitHub, Inc., Stefan Ries, JetBrains s.r.o., Intel(R) Rapid Storage Technology, Waves Inc, Dell Inc, Lenovo, DameWare Development, LLC., Essential Objects, Inc*, HP Inc., Aina Maximit Oy, Logitech Inc, N-ABLE TECHNOLOGIES LTD, Cognizant TriZetto Software Group, Inc., win.acme.simple@gmail.com, Crownalytics, LLC, Kodak Alaris Inc., JAM Software GmbH, UBISOFT ENTERTAINMENT INC., DASSAULT SYSTEMES SE, Link Data Security A/S, Western Digital Technologies, Inc., Rockstar Games, Inc., SEMPERIS INC., Micro-Star International CO., LTD., Kaseya Holdings Inc, KASEYA US LLC, Intel(R) Software Development Products, AAC Infotray AG, CORE.AI SCIENTIFIC TECHNOLOGIES PRIVATE LIMITED, ClaimMaster Software LLC, Cellebrite DI LTD, Riot Games, Inc., Autodesk, Inc., ACCA software S.p.A., Tempus Technologies, Inc., NextgenId, Inc., Cloud Software Group, Inc., Bloomberg LP, GEO NETWORK SRL, Geo Network - S.R.L., FARO Technologies Inc, Axis Communications AB, EWA Technologies, Inc. | excludes:process.code_signature.subject_name |
process.executable | wildcard | ?:\Program Files (x86)\*, ?:\Program Files\*, ?:\ProgramData\*, ?:\Users\*\AppData\* | excludes:process.executable |
process.command_line | match | PcaSvc.dll,PcaPatchSdbTask | excludes:process.command_line field:"process.command_line" value:"PcaSvc.dll,PcaPatchSdbTask" |
process.parent.executable | eq | ?:\Windows\System32\svchost.exe | excludes:process.parent.executable field:"process.parent.executable" value:"?:\Windows\System32\svchost.exe" |
user.id | eq | S-1-5-18 | excludes:user.id field:"user.id" value:"S-1-5-18" |
process.command_line | match | zzzzInvokeManagedCustomActionOutOfProc | excludes:process.command_line field:"process.command_line" value:"zzzzInvokeManagedCustomActionOutOfProc" |
process.parent.executable | wildcard | ?:\Windows\sys*\msiexec.exe | excludes:process.parent.executable field:"process.parent.executable" value:"?:\Windows\sys*\msiexec.exe" |
process.executable | eq | ?:\WINDOWS\SysWOW64\DWRCS.EXE | excludes:process.executable field:"process.executable" value:"?:\WINDOWS\SysWOW64\DWRCS.EXE" |
process.parent.args | eq | -service | excludes:process.parent.args field:"process.parent.args" value:"-service" |
process.parent.executable | eq | ?:\WINDOWS\SysWOW64\DWRCS.EXE | excludes:process.parent.executable field:"process.parent.executable" value:"?:\WINDOWS\SysWOW64\DWRCS.EXE" |
process.executable | eq | ?:\Windows\SysWOW64\DWRCST.EXE, ?:\Windows\SysWOW64\DWRCS.EXE | excludes:process.executable field:"process.executable" value:"?:\Windows\SysWOW64\DWRCST.EXE" field:"process.executable" value:"?:\Windows\SysWOW64\DWRCS.EXE" |
process.parent.executable | eq | ?:\WINDOWS\SysWOW64\runonce.exe, ?:\Windows\SysWOW64\DWRCST.EXE, ?:\Windows\SysWOW64\DWRCS.EXE | excludes:process.parent.executable field:"process.parent.executable" value:"?:\WINDOWS\SysWOW64\runonce.exe" field:"process.parent.executable" value:"?:\Windows\SysWOW64\DWRCST.EXE" field:"process.parent.executable" value:"?:\Windows\SysWOW64\DWRCS.EXE" |
process.executable | eq | ?:\Windows\System32\Essentials\SharedServiceHost.exe | excludes:process.executable field:"process.executable" value:"?:\Windows\System32\Essentials\SharedServiceHost.exe" |
process.parent.executable | eq | ?:\Windows\System32\services.exe | excludes:process.parent.executable field:"process.parent.executable" value:"?:\Windows\System32\services.exe" |
process.executable | eq | ?:\Windows\System32\LogonUI.exe | excludes:process.executable field:"process.executable" value:"?:\Windows\System32\LogonUI.exe" |
process.parent.executable | eq | ?:\Windows\System32\winlogon.exe | excludes:process.parent.executable field:"process.parent.executable" value:"?:\Windows\System32\winlogon.exe" |
process.executable | eq | ?:\Windows\System32\inetsrv\w3wp.exe | excludes:process.executable field:"process.executable" value:"?:\Windows\System32\inetsrv\w3wp.exe" |
process.parent.executable | eq | ?:\Windows\System32\inetsrv\w3wp.exe, ?:\Windows\System32\svchost.exe | excludes:process.parent.executable field:"process.parent.executable" value:"?:\Windows\System32\inetsrv\w3wp.exe" field:"process.parent.executable" value:"?:\Windows\System32\svchost.exe" |
process.executable | eq | ?:\Windows\system32\winsat.exe | excludes:process.executable field:"process.executable" value:"?:\Windows\system32\winsat.exe" |
process.parent.args | eq | sysmain.dll,PfSvWsSwapAssessmentTask | excludes:process.parent.args field:"process.parent.args" value:"sysmain.dll,PfSvWsSwapAssessmentTask" |
process.parent.executable | eq | ?:\Windows\system32\rundll32.exe | excludes:process.parent.executable field:"process.parent.executable" value:"?:\Windows\system32\rundll32.exe" |
process.executable | wildcard | ?:\Windows\Microsoft.NET\Framework*\mscorsvw.exe | excludes:process.executable field:"process.executable" value:"?:\Windows\Microsoft.NET\Framework*\mscorsvw.exe" |
process.parent.executable | wildcard | ?:\Windows\Microsoft.NET\Framework*\ngen.exe | excludes:process.parent.executable field:"process.parent.executable" value:"?:\Windows\Microsoft.NET\Framework*\ngen.exe" |
process.name | eq | powershell.exe | excludes:process.name field:"process.name" value:"powershell.exe" |
process.parent.executable | wildcard | ?:\Program Files (x86)\Lenovo\VantageService\*\LenovoVantage-(LenovoSystemUpdateAddin).exe | excludes:process.parent.executable field:"process.parent.executable" value:"?:\Program Files (x86)\Lenovo\VantageService\*\LenovoVantage-(LenovoSystemUpdateAddin).exe" |
process.Ext.token.integrity_level_name | eq | low | excludes:process.Ext.token.integrity_level_name field:"process.Ext.token.integrity_level_name" value:"low" |
process.executable | eq | C:\Program Files (x86)\MultiExtractor\MultiExtractor.exe, C:\Program Files (x86)\Naverisk\Agent\Packages\SoftwareScanPackage\SoftwareScanner\Naverisk.Agent.SoftwareScanner.exe | excludes:process.executable field:"process.executable" value:"C:\Program Files (x86)\MultiExtractor\MultiExtractor.exe" field:"process.executable" value:"C:\Program Files (x86)\Naverisk\Agent\Packages\SoftwareScanPackage\SoftwareScanner\Naverisk.Agent.SoftwareScanner.exe" |
process.executable | wildcard | ?:\Windows\Microsoft.NET\Framework*\NGenTask.exe, ?:\Windows\Microsoft.NET\Framework*\ngen.exe | excludes:process.executable field:"process.executable" value:"?:\Windows\Microsoft.NET\Framework*\NGenTask.exe" field:"process.executable" value:"?:\Windows\Microsoft.NET\Framework*\ngen.exe" |
process.hash.sha256 | in | 07e79814fde31ff5968d5c0448014d931cd3a2e59b2ac841bc53a155c333a1b9, 0ab8a14e7fd42818608cc0916fc26a12b2ae6b976c97310dc86011713e455d2d, 1005dcfddfbde91cc967ecc6d778c81cb4f7bede03121a3e6e0d9bae12a033e0, 121a4e78abe13c92a7ff91d2e91bc98173724072cc891ecbbc10765e8d5bd024, 183cd12fbdd93aa785d3793a8872c4a9730dd154f6482c39f94552e556a7b4e9, 18b177280b0e0e05aa0e26807f34634c3384ae4f5901f41ff5bb0a720ea5c106, 1c237e9015c81487aa67d56f8aa4788fbb6bfb3039e455485376712cfc978e62, 30534b04d137543932bc0e66fc778d772ca5d90c0b5faec74a842cad8d50ade8, 35542bc04fbfa2e3ef68837640e0459c6f99729c0c73578c08ab351cdf030696, 35f210c1f941f917b81c2516bee9de8f0495baca42095685e9b0b76f67250dc9, 43714f0fc5cea25a6ee936fd36a83f86a45f61447c16c8e9255ef317089ce39c, 43a84e01b5ddecf0b6297277d53c72025a73b00b9f0073933a700695a240b5e8, 47585eb41299f97c88028c3dae3ba6049355b8e0a8074abeae9f4f9381832c20, 49113f4cd7bbf3343a43b13edd745008c4f41da1d80c9f89dc90a4b0bb39b8f8, 49b95a804337ee7e12092cc7a13c2eb6c3acb33f9bbaac8e820b9184063642f2, 4acdfb075f5a801b976819cd22bc3a930ad5f8ee92de2d5ad36b0a4f1e5a8b24, 4c974212f5fc3720d58a8df6c2b9587b85949edc676f9f82921c04f067c261f1, 4f1528318085f6117734a27f34a317a83b096d55532000f81ed67b1bb10632fa, 51346e95656164783ae4de9d6b202f28be87358eb0e056d2d7cdd12b502d30e7, 52a5036d1578a6b899fb5d14fd3ab12af463e94ac791d1dddb22b7e8cc1f4bd7, 53cec44e4fc9a3477d264c5edc9e376af8fcca20853faa289387f5bd7eaae05f, 54e55d6da825d709cf495eb18be10d8cbb92ac1904c1359999d53d3fa42161e2, 63f2a4be0dfbaf2b9740aa5c2320d0290451d6d5581cc6f8e183ced9ea796d95, 889cb8827a400984bea2e0561a1efbf9d18044e879974da8baa750a0c63748c6, 8982729121fa3b3e6c283437f5832916a5a3611374ac848368c6edaae5086257, 96dcdb449ab48b21b6efd33afc59ae163dea5fc597ffaf5dd7030b20d2624467, a26dfec1922d751c710a2f2ab16a33facb6fef8997d21784681f1be637a78b5d, afa3dc1ecd4e15a869dc57a280aee930fc0bab1cd49e17afd3944ae4ad1fc91f, afcee50eace500b9b2c3dc4faab371fd040d769ba3a5197ef3a8762fe5457337, b4aa6923bd807af4433c968aa1ded17a3bf8e36f1053fe24dc31dd5a8eb9f4ce, be92c45eeb7ffb4b3bf62b76b3218a0c4cdcfa52c8ddb5a47b9abc407dda282e, ca52dce8cc2aecc23138a524683ad608b4a5eaed9a7a10336e4cf6c7b9d6e5e0, cffea8d18419170baded53d75a8d1b8d20170c21ef2d4bebddfb2efcb89a641c, e7883c7d57f5cfe7d1649ab138f62f5042f7acda8ed3c8664c9335c3ddba85c4, ed3730a3436454022e8cf1a27569babef8c9c348ea875f1df80cba9b743365c9, ed6c844c72fccd7e7799d448f5e74df368cafd2631858573e6e29110c213ac79, edef301528767963f460bf7fe497ca3b5c648627a2d13abe74d5544578b56bd4, f4cb2a001dcee0577046c56df5adfe989bc875c29ecfe27c9569849a9a6f0671, f5f15ab19171dbcb58e757cd6446be41e04adf00797d712b07e544066ecd3c67, f856a3c582ca689bdea3e784ef6a0db37011bd5ebb31d7c79d0328ebfcf6d8a4, fc0ea005db332feec00e6c34e36de85469d24074c8af23cea84b72eb0fa7fb85, fe62ba0a61191a9b54aab7ba3221479c451b042fa30a08957cacff84ddfe094b | excludes:process.hash.sha256 |
process.parent.executable | wildcard | ?:\Program Files (x86)\Advanced Monitoring Agent\featureres\PMESetup.exe, ?:\PROGRA~2\ADVANC~1\featureres\PMESetup.exe, ?:\PROGRA~2\ADVANC~1\downloads\NetworkManagementInstall.exe, ?:\PROGRA~2\ADVANC~1\staging\_new_setup.exe, ?:\PROGRA~2\ADVANC~1\downloads\MAV-Installer.exe, ?:\Program Files (x86)\LiongardInc\*\node.exe, C:\WINDOWS\_ScriptingFramework\Modul\Engine.exe, C:\Program Files\IperiusRemote\GlantzSupportClient.exe, C:\Program Files (x86)\ReluxDesktop\converter\Raster2Vector.exe, C:\Program Files (x86)\Assinador Serpro\uninstall.exe | excludes:process.parent.executable |
process.pe.imphash | in | 45e4653ae633e067079dd72666b0158b, d41d8cd98f00b204e9800998ecf8427e | excludes:process.pe.imphash field:"process.pe.imphash" value:"45e4653ae633e067079dd72666b0158b" field:"process.pe.imphash" value:"d41d8cd98f00b204e9800998ecf8427e" |
user.id | in | S-1-5-19, S-1-5-20 | excludes:user.id field:"user.id" value:"S-1-5-19" field:"user.id" value:"S-1-5-20" |
process.thread.Ext.call_stack | array_any | excludes:process.thread.Ext.call_stack |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
dll.name | in |
| field:"dll.name" kind:in |
event.action | eq |
| field:"EventType" kind:eq |
process.parent.executable | is_not_null | field:"ParentImage" kind:is_not_null | |
process.thread.Ext.call_stack_contains_unbacked | eq |
| field:"process.thread.Ext.call_stack_contains_unbacked" kind:eq value:"true" |
process.thread.Ext.call_stack_summary | in |
| field:"process.thread.Ext.call_stack_summary" kind:in |
process.thread.Ext.call_stack_summary | starts_with |
| field:"process.thread.Ext.call_stack_summary" kind:starts_with |