Detection rules › Elastic
Remote Memory Write to Trusted Target Process
Identifies attempts to write or modify protection to the address space of a remote trusted target process and by an unsigned or untrusted final user module. This behavior is consistent with remote code injection attacks.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth |
Rule body
[rule]
description = """
Identifies attempts to write or modify protection to the address space of a remote trusted target process and by an
unsigned or untrusted final user module. This behavior is consistent with remote code injection attacks.
"""
id = "5c6c166c-a894-4263-918a-c7632014a486"
license = "Elastic License v2"
name = "Remote Memory Write to Trusted Target Process"
os_list = ["windows"]
version = "1.0.14"
query = '''
api where process.Ext.api.name == "WriteProcessMemory" and
process.executable != null and Target.process.executable != null and
process.Ext.api.behaviors == "cross-process" and
Target.process.executable != process.executable and not process.Ext.api.summary like "*Unknown*" and
Target.process.executable : ("?:\\Windows\\*", "?:\\Program Files*") and
/* WPM triggers multiple times at process creation */
not (_arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like ("*\\kernelbase.dll!CreateProcess*", "*\\kernelbase.dll+0x*"))
and process.Ext.api.summary like ("*PEB*", "*PEB32*", "*ProcessStartupInfo*")) and
not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like "c:\\windows\\system32\\ntdll.dll!Ldr*") and
not (process.Ext.api.summary like ("*PEB*", "*PEB32*", "*ProcessStartupInfo*") and
process.thread.Ext.call_stack_summary like "ntdll.dll|*Unknown*") and
/* excluding trusted code signature */
process.thread.Ext.call_stack_final_user_module.code_signature != null and
not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true) and
not (process.name : "rundll32.exe" and process.Ext.api.parameters.size <= 140 and
_arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.subject_name == "Barco N.V." and $entry.status in ("errorTimeStamp", "errorUntrustedRoot"))) and
not (process.executable : ("\\\\?\\Volume{*}\\*.exe", "\\\\?\\Volume{*}\\*.exe") and process.thread.Ext.call_stack_final_user_module.path like "?:\\*\\docker\\*\\windows\\*.dll") and
not process.thread.Ext.call_stack_final_user_module.name in ("Unknown", "Undetermined", "Kernel") and
not (Target.process.executable : "C:\\Windows\\SysWOW64\\explorer.exe" and process.Ext.api.parameters.size < 3200 and
process.Ext.api.metadata.target_address_name == "Unbacked") and
/* excluding multiple unsigned third party modules from programfiles */
not process.thread.Ext.call_stack_final_user_module.path like
("?:\\windows\\assembly\\nativeimages_*",
"?:\\windows\\winsxs\\*.dll",
"?:\\program files\\*",
"?:\\program files (x86)\\*",
"c:\\windows\\apppatch\\ummon.dll",
"c:\\windows\\apppatch\\apppatch64\\ummon.dll",
"c:\\windows\\system32\\ctiuser.dll",
"c:\\windows\\syswow64\\ctiuser.dll",
"c:\\windows\\system32\\hpzipm12.dll",
"c:\\windows\\system32\\lsasrv.dll",
"c:\\windows\\syswow64\\cwbunpls.dll",
"c:\\windows\\system32\\shsvcs.dll",
"c:\\windows\\system32\\sxssrv.dll",
"c:\\windows\\syswow64\\pgpce.dll",
"c:\\windows\\system32\\hmpalert.dll",
"c:\\windows\\system32\\cloudap.dll") and
not process.thread.Ext.call_stack_final_user_module.protection_provenance in ("mfehcthe.dll", "system.core.ni.dll") and
not process.thread.Ext.call_stack_final_user_module.protection_provenance_path like ("?:\\program files\\*", "?:\\program files (x86)\\*", "c:\\windows\\assembly\\nativeimages_*") and
not (process.thread.Ext.call_stack_final_user_module.name == "mscordbi.dll" and
process.executable : "C:\\Program Files\\Microsoft Visual Studio\\*\\Common?\\IDE\\devenv.exe") and
not (process.parent.executable : "C:\\Program Files (x86)\\InstallShield Installation Information\\*\\setup.exe" and
Target.process.executable : "C:\\Windows\\SysWOW64\\explorer.exe") and
not (process.executable : "C:\\Program Files\\Microsoft Visual Studio\\*\\link.exe" and
process.parent.executable : "C:\\Program Files\\Microsoft Visual Studio\\*\\MSBuild\\*\\Tracker.exe") and
not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
("27fe00d32f773a95e6d50986e5e7499917f66ce881e46054c77652ef4bdf3512",
"a59e039e1520b74254a454bf48c2bceeafe7bd7ac6e5886baa482a52f86a29bf",
"f01bb9aba3f9daf4d8f5551a3b753d8011e16072a1103cf5303d617a9f866424",
"16184cf6f54d6ac4eb0a31c0e9ee8ae775bae6dfdc632e283e832f3e89de595d",
"c983d11ad519a851aca2d37739110b7913819bea1ddf2cc3ec69efe3ed3b609f",
"c3cd2439a6175ce28192904e72b14523b02559d8083a710b5e82aee400626d1a",
"7396f943823494d2ec5f2260329daa2d35b1764f01cdefd95f84ae320986a8f3",
"efd03f2525e69cdc30b5736af74d9485728b8a94d5624da87f1431b3706980ab",
"8eb0721092af3131a940f1e23bc2871e09362980e0b71a7ed7dab6e8accd1f30",
"6edb20df25d1cf0fd1b27052f2604a05db1d7ca5a3f074e7bacc229e28d17667",
"67435999749d9e6908a4029321c0c6f9e915135e98e01a7e499a1c55a960bc68",
"914299dd77f4322c99f62c37df1317ea3424d9a747d4635d10c1d3f003f6abd4",
"51b63860fd996d6d5b1753ba6bb7f3a4303f13187fbfecc96ba2b6bae52a7410",
"0255b5bf7ad66aa090be145f0ad41a0f4e33409ff5c2970081fccd863c720779",
"925a5cd982933bae1b271e1aaaa887ab469397701cd299f4397ddd8af5a351f9",
"9cb1208f1747963dc57e8bf8a8fe82b3aaa856caae3d151b6a6b97b23369f5a6",
"681303f5b5688075b5b504819d8b3c343c78e3240a3bccf371e03228970ffb10",
"30b59303bec45b020b4878b2d33d63bd719d89820456a7ee0a920178efe089f4",
"8ee5bd6fea98577bd29c15055e96ec17c62ca415f4a5d26065b25a922b19d3b1",
"57854d83b50ff0a23d47c077d6da875874ea78f88f28168d8e99ffbf9f1c3153",
"c4788275a5ed2c1576e69b59e6e267ce573450ff07e54b799ec4c4edef40b502",
"a4637935f895de601850c6868d952977a84076a7b1719d0deb519f1fc0871be4",
"a99ac2554c1e392ffe3cd53f7f72f76638948533795fc04f7e15454c386b7eec",
"b031da6137f9442a6cc9f4b4546b4057b666726cb7c9224c4ca857a60f2ec1e1",
"586d8eeaec3a439978836a512bf2f5a987cbe2ba72e5bb10322d04cd65fe8d09",
"ebdc2c2cedd5e549ba8d5e3f474d29204e1cf073e2b26e75f60bb429d2b5a088",
"80eb757f729a943ff0919df1eb980b80f8419f76648407834d95c76adfd21624",
"e71eb30f24c82bc4fa1c645eecbe343f5a44526043fc3a13047183dac5f212f3",
"c46f9f3c710ff2baabea480670220e0328e7bcc2aa3c598c3f982728e0b5652d",
"7f1ab7572a89534366172df3ae5f0182aab1ae3ef992b684a84c5c1a10e8315f",
"d7624e57820ccd1bae7881e08af40bc3522971278018fdfbe0ca98302292165c",
"e0f11ad44d1c1e11f9308f9aaee4d8bcac86ff6e0b4a41d1e75879f6cfd56049",
"2266a567ba921d1c2661258cd5b31150274cb781ac01413c34a471557123ba65",
"1f2e936a57994e16b457f249a64af4786877f7beaab003fb521a20e45031f408",
"e8eaf74988082b8c8222dabed68218069c8eb4e93acd3619a776bc28d39e5ce5",
"39fdb47a5f349e06bbb7dc1cedcc81a051d1dffe373956871325f8327e858afa",
"f7af5eac1d34a2ddc619dd0c3172ec28334b8d79efc1f8ad758124b7e5aae0d5",
"8f3d19065d0d1295bbfbf7591aa02af3a5dc70fde74bac670c18ccd8f7306008",
"d6b771bedda261bcfe9dd1d1402b7d33b5cd2764cd53d941957e32920cfbeb19",
"3e02857de5a59331e1f7fc7e1ddf5ae58e8680d298bb44b49bd316e0b3a1f024",
"954b4385cf4faecfbf9cd04e01c059eb09113a78ee727149b63a65b495a28a6c",
"8851b734602eb00da5b1cfc1e40d38f1cb32e0add2df257ff9d7dbd520b4d5da",
"b2d86212afab00e7b9bf19b7931277130b653c9258ac419a7a24d749471ea5ac",
"5231df995d71991ee4108937bb12e4d3f344a96fb0c4cd82c14e18061d6c4730",
"4daef5be9503c580697b36b0b60a702c109e23840c0632ca00ef4a233603018e",
"fd788a077e026905f1565e0d2a65dfc6c55699c098a59879d6b0b3f3b8459ae8",
"dc641636d5d782b31d29ce823e951d1a2164c86ee06bf2f65a841360fb7af356",
"fb4a05ce7d50721c71f66c37e0ab7e52cd46034a2e394940b3f60c9c2afb079a",
"862a7e8c68f05b91ecf3a43ac5b60c6f57ee50fa98ad1b539480d541628f5c2e",
"44c87532cbb511c369b38a105fc5a84b1d89dba9dfdd5a62c311d6176fe93201",
"465aade5769d4cae2ca1f365ca634440a0444ca0ce319171c140c362d12859c4",
"d615af8e012426c8847c750a0838159d6c41385d2e50388cea28a97999b81614",
"9c63bfc10af9e801f0a009cb5e3c3c097d5eae8ee00351e2bcaa672ead352df4",
"8bca3967254a38d6789c90afe136e34e96b5840b3fc77826dcf3c73b44016ea2",
"dc2d5b2d59a18cd4e749d2cd709e4ada3751ef59d188a8bbab1bbd7562f2d609",
"759f7e4d46e10d3de2fad228994ae8bb142ff171082d175b5d233895efa047be",
"bea84d6541a56c63c570d7b637d18b4de3348c6f8b96b536002da1e7c268879f",
"bc66341f3d2cd4d5216612869731a9f653fa4d75b429ee944a0802ae9457367f",
"5497ff34548a2a0c948024e0d4f21005c18f82ed01246ee98dbb33c0389670c8",
"ebbc8af232a86e870ecf0cbb3f6c3dc79e740c14e907437bab449e2a1e098ed3",
"f3cb863c2a8f16a5f1a4ec5a4d7036f7a0b444cbd4f52226c0d463154e8d5428",
"646c951524f1fab3aaa70a4cff9469ab658a2a0bdeea4e88aa18072c54c83430",
"c79d56dacc8e28b662dcc5fe922453d225441bfa73656942beb205bf4ad20066",
"d0735ca28e1f806da75e83a8405ed431d991c7476bc79c8be6c7b27ccce0ac31",
"175184977cf02e59af9674a24a2f2b0d8278bf886f9f7e05ef8878b5364dc3bb",
"7214d926419fe847a4795a74f9b73209990e4927bb5b56128cf30703be68cde7",
"f7c78dba07128af325d8da99138ebf78be163ecfb5da5b01fa6b65b96efecef1",
"5bcb5bd390665792c5e597bcc569caa9bfb942ef7946014eb60dcef0fcf586a6",
"07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a",
"3d171205aec848f93b721891806ff86b36ba639923067f6e5dabc4cf500f5831",
"7b55a781fef86de1dd56f8956b5160d74de10c9c9179e7f5b38331eb4eefd9af",
"593384d6a5d77c75426c0fe7d93663d24e9797548dd52ff8d60f9c25ac0b70f9",
"67fffdf1b96050f8eca6e844cb23fcee2ef54f85fbfb7786ad9d6d3c39d84415",
"e3fdcd2b4c5215e74b0cabe91ce7fe2800cbf8e2a28157342960bca61bbd6b5d",
"bd6843726688bd7253a42180bf95671ad5b0f9e787adb4f13250f484abd9eae4",
"4f1f25bb19905c34bf75436d32c48df96afd9872c0f5fc5ab45e31f9783e1ace",
"0d6ff0e37139ee86d2991d2b8389f36316778ddb6e44a6d6c727e2d4b87693a5",
"6e54f990149523e9b25c4dd804986f55bdbf846ba1261f8a0ba285cdfabe0bab",
"2c8483ea06618e3c501678e4b7bd77f2e1c068cfa88c0f168abffa5f78b328ea",
"03e03d5726da2ca346a0130cf01b7fa4af46b5f8b9370d1cf63ddde1c72dd6d2",
"0d6ff0e37139ee86d2991d2b8389f36316778ddb6e44a6d6c727e2d4b87693a5",
"494ee86d2a538f23fcfbab1507612637b4af2b97166ed1e3b5f86da74506bca4",
"341f3841335bf2e4e2d2fe39672c591fbc819b0b64b654fc198000234fb8052b",
"9840c97b35afb77418d541ef2f1b5da93c0d7d9632c334ec7444ceadeb0f9fa8",
"27f6d804c989ddae14c94768240c639e14fc94bac4a56156c4f1925682004f89",
"ddcbecf2cd2cd4904cf21e3db40c6a918df0ed3b258473fc5d6e2688dee72696",
"4e4b9bcef90731eb9b1306610fc89ba31296a5875ff5ba628f7271130aa61280",
"35e1443640e39922f5488cba77b10fd97a58c65e0c4d2a0dcdd16a276c3677e1",
"b152de9afc373bba831dc9c1b137668462ae6d46ccd46815f2ffcc7f1bfc7056",
"c9b456c3722c60e680e8bbf3a8c9aad55bbea6af0f8de7340e4573b23b1272b6",
"472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c",
"cd4aa919f346bee759d4aded15c57901026307446546f8c296fa706e2e109095",
"e3a6a3337494667a6cfd7578e9a6c6b5f17f4cac82ae9a98d56cd4c2ae701542",
"0884f057877298b3dd93f3ffd749692820f7e8df52f907480484dab5000048f4",
"7291b1c32671f5416ea33d1f14ca6a36dc77e166a12e6a3868ba68b9ebfdc3d3",
"00bf4e4083d79196e54b39e2d957b25b50807c922d3cc09f5661215536895f4b",
"fdef73d692e2e181075bf43a05cd7ebe551f6b1be31f4d471ff709f83a549612",
"6eed2886728608f1b3f4a54a7a7d338ef1b1669f6f53a5d38bcd352f0ec755c9",
"9840c97b35afb77418d541ef2f1b5da93c0d7d9632c334ec7444ceadeb0f9fa8",
"418a7dc57d5ac225d7f012fe90a1668a797fde56c9add6c3aad841ab0c1e2bc1",
"42215642c3c1ec4c578b9c03cbe8cd93cdf20abe33687473da2d25d5f5efe0a9",
"1dfc0c4f5442dcff2082d9258254b6861c27001aada055d960844561e699655b",
"e09a338081b83a42e97b60311d9af749baaedb226b155d9e7bd658de1c5a349d",
"1fa7ef783a81ed730bd40540e0aec4c1b42ba7eef52ddb28311f2086580db766",
"1f8a5ff26f722b380754d794ad4b8d9edf69361e18ea0a2a03ed58d61e91849c",
"c5d10c310306c223b66ebf1595db00d581d4eff1a0615d4d309cd9160f85a008",
"538837e2f9bdb764d6ec799c89348bd483d51e72b3f91b6bc5e30a1bdcae24bf",
"b0fda4dd268633f34e75e03fb0c79ed9512b5fb4ecf7b85989e2b7744f7b7974",
"722cb3292042a573a1f56a535d1986fd8496261ba68e6d60a32599701df617c7",
"615ac4399eed0a26e5cd9bba4e7dcf661400fb0546dce067523fe275351d3b04",
"c750bdf07966a69d1423dda5deb3413d312e319c9dd1193f354eb48310208370",
"d0a62a67891bbd4eb263d328e5bf6da080bcd7d16c3b1d73e563a48263062c5a",
"cd0e1ca821e92ae426cbd30daf44ae3580ec4070c734b2d411376a5e6a874e97",
"ccae2a12091763da594e0ceb83e3aa438bccf2449b2dc91c916232ba2117ae22",
"16bbdb339173d25b4332b377da96e80809aabfe6739cf35d5e70484f08cfdc42",
"d355b62cc7dc5b8f3ee5e95a8ddddc818f6f84c5a16799d78b1cb3d786e2bb80",
"8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe",
"fe04a6ca7c35330dd0adf681aaf85ce9f6342a027c74776ea09e30517e02acd1",
"379952ec8113b3692872ffb9d07c242968ee1edfac9b3b888496c1480033be91",
"4ab37b0f9c5fe3505e1ecfe0764aaa04838cf81f9e0a402425e057f7a251e621",
"ab7ba2df709c5ff7ee16a1038deaf1d795977b035a1ba08cc6d32ea9ff87bd80",
"a6967e7a3c2251812dd6b3fa0265fb7b61aadc568f562a98c50c345908c6e827",
"68a9b8395bc4593deff311046193ef71444767359622538c848363ddb1afb4c0",
"c982aa3d9e2bce5a6faec7a767f58ba6a622f07e7af6ca8abee4eb6b12492574",
"06990109b285c72e65d9f3f803738ee874a4dc9d505f384eee93b7bb6a8cf9b8",
"98c2ddea9b192883eae55567908722a981a1bed1f55ef0b4bacc984530c85292",
"7dc65ca4c511808d59ebf73eb8810cc3e6e62ed7229ac53bd1cce0e6d8f9b60f",
"bb1e5c4b390f31630fa87da5ee2ce326811f3566c58c16b2a68c9cff9c269fb7",
"9344363df85bc76135431e64f3be606355a8c33d6ea9918573b53500537a1f2b",
"809ff63ca16058e93474ada89f45f832aeac705b032004745fd06fe15b4942c3",
"771af46d1e8f21d303cdd81c91206986c40e1671b092e039cea3a7f3d250492a",
"a3800ebd1797b54aded5134cc9b93df3051b1aaa74a619c4a5223d5a1979dce1",
"c729c4b5a6ad8d247acd4b0d32d5a5999647461ee5f565c618b26d339caebbca",
"17aad91089b18cd97d7ddadbe9873cfde18bf3cb998623a8dfd3aa85006ce736",
"e2f9e698b01ea5e525396ddb86d5dbfcf85f6f19d6e9b8e4f1d75cbcd0da626d",
"237e9b49a376436896837ad26bcf3fc7776ec382395bdd99ccf9bc844fe16326",
"426ed7db4bbf0dcc03ce2f27ca844147547a429399e4def018492a0b828775ca",
"b946e5cce23efb43520850c4d24cd03177e62f959341a99d01fdefa17864aad9",
"6ecdd9b65df1281b3df79594064eecec8be0a0f3769caf7ea65031947d9546fb",
"da8a30160ab0fe450cc42aad45999e22ea848ac9a98814d420c4da884e733e22",
"c0106d2c7f43ffb28532537cdfdb0085d2f0de1e595736fd4e62a68670bb15ae",
"0ec1018ec231baee086a680d535847d478dc843adcafcf007f143d6c905637be",
"552bee0c0d9af1399022451accd3fd527fe865428658482196ecf45432f7a235",
"e44286422a2e26d4813dc78e2215a0dd1a074d0fca4c12eb19f532338f714d2b",
"135766eefef4af765ad7f2fcd0b4f72c0d9e8d1364c21a508c0ce66dae294f20",
"0a48fd481cc5901b6a1608b58e55823d77cef5bd2897392f201a450af301292e",
"21d741e2c5089776a535587cd5fcd933b51054e16bf8e50855e74e68b3790228",
"11d174e1e922a8e644bdd2b5287879445cc6ff0117ef553d5ce6390f1bb49cb5",
"69a56fd6a22193044336b1ee6548efcc992ab3e51f617d772a32f5e12cdef998",
"d1c43b02455df6ed98a5c1fe1ac16284706ed4bd76a784c332dd6b2bec90183f",
"ff31fa811f9c07cc7fdaa68c9e8bca3a7b4fdf6e0a079a58175ea58ba139c7ae",
"25fbc88c7c967266f041ae4d47c2eae0b96086f9e440cca10729103aee7ef6cd",
"af3d6298a8cd7293479f77eab032478e766dae44749489b9568c9fa50ce70890",
"ba2616674f60ba0b977900bed95dbfb9fad2ad6084cbf90f831fc06c1bfb2f23",
"12296a09402575cf107cf0c8b87a31716de1f56896f512aab6e6e86e13247350",
"11d87cac25f6d438db6c6dfec631f97fa5f6ad98e7d99fa50ac1479706efb3b5",
"37cf45f320b9bc4ca198bd93ac1f7882756d82f491809ea4f8907c69cfe1c9ae",
"b2c5905e7e7da322d7be5b2a5552c37345f678b9f69c14c630a1bd1186455c1f",
"176d01497ed5abfedd82db3889a0f8f60a8e254fe841d95cda94de20e0dd4b42",
"250c5f755d35a56189c7d557f1ea3b2827f26ff83c563df8a6cedb0114777fc0",
"f3553d5c7a36f67eb9934cc372ded8c2d592ae671ebd4297b0fbfd1cedad4205",
"0740759a6e479b0ff718e00c6f2d5f3c67db2ac31c787d2caa7e683588c23a03",
"4e0421b9849e2f873399832c44c1e858eef3dc37ac2ccd6dcb340ad35dfab63a",
"cb7ab3788d10940df874acd97b1821bbb5ee4a91f3eec11982bb5bf7a3c96443",
"5b6929aaaa7bd05bcaa5baa7ce8c4243804d6989f1c97ca44726ed124b49e9bb") and
not (process.executable : "C:\\Program Files (x86)\\Microsoft Visual Studio*\\bin\\lib.exe" and
Target.process.executable : "C:\\Program Files (x86)\\Microsoft Visual Studio*.exe" and process.thread.Ext.call_stack_final_user_module.name == "qt5xml.dll")
'''
min_endpoint_version = "8.14.2"
[[actions]]
action = "kill_process"
field = "Target.process.entity_id"
state = 0
tree = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true
[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "8.14.2"
Stages and Predicates
Stage 1: api
api where process.Ext.api.name == "WriteProcessMemory" and
process.executable != null and Target.process.executable != null and
process.Ext.api.behaviors == "cross-process" and
Target.process.executable != process.executable and not process.Ext.api.summary like "*Unknown*" and
Target.process.executable : ("?:\\Windows\\*", "?:\\Program Files*") and
not (_arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like ("*\\kernelbase.dll!CreateProcess*", "*\\kernelbase.dll+0x*"))
and process.Ext.api.summary like ("*PEB*", "*PEB32*", "*ProcessStartupInfo*")) and
not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like "c:\\windows\\system32\\ntdll.dll!Ldr*") and
not (process.Ext.api.summary like ("*PEB*", "*PEB32*", "*ProcessStartupInfo*") and
process.thread.Ext.call_stack_summary like "ntdll.dll|*Unknown*") and
process.thread.Ext.call_stack_final_user_module.code_signature != null and
not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true) and
not (process.name : "rundll32.exe" and process.Ext.api.parameters.size <= 140 and
_arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.subject_name == "Barco N.V." and $entry.status in ("errorTimeStamp", "errorUntrustedRoot"))) and
not (process.executable : ("\\\\?\\Volume{*}\\*.exe", "\\\\?\\Volume{*}\\*.exe") and process.thread.Ext.call_stack_final_user_module.path like "?:\\*\\docker\\*\\windows\\*.dll") and
not process.thread.Ext.call_stack_final_user_module.name in ("Unknown", "Undetermined", "Kernel") and
not (Target.process.executable : "C:\\Windows\\SysWOW64\\explorer.exe" and process.Ext.api.parameters.size < 3200 and
process.Ext.api.metadata.target_address_name == "Unbacked") and
not process.thread.Ext.call_stack_final_user_module.path like
("?:\\windows\\assembly\\nativeimages_*",
"?:\\windows\\winsxs\\*.dll",
"?:\\program files\\*",
"?:\\program files (x86)\\*",
"c:\\windows\\apppatch\\ummon.dll",
"c:\\windows\\apppatch\\apppatch64\\ummon.dll",
"c:\\windows\\system32\\ctiuser.dll",
"c:\\windows\\syswow64\\ctiuser.dll",
"c:\\windows\\system32\\hpzipm12.dll",
"c:\\windows\\system32\\lsasrv.dll",
"c:\\windows\\syswow64\\cwbunpls.dll",
"c:\\windows\\system32\\shsvcs.dll",
"c:\\windows\\system32\\sxssrv.dll",
"c:\\windows\\syswow64\\pgpce.dll",
"c:\\windows\\system32\\hmpalert.dll",
"c:\\windows\\system32\\cloudap.dll") and
not process.thread.Ext.call_stack_final_user_module.protection_provenance in ("mfehcthe.dll", "system.core.ni.dll") and
not process.thread.Ext.call_stack_final_user_module.protection_provenance_path like ("?:\\program files\\*", "?:\\program files (x86)\\*", "c:\\windows\\assembly\\nativeimages_*") and
not (process.thread.Ext.call_stack_final_user_module.name == "mscordbi.dll" and
process.executable : "C:\\Program Files\\Microsoft Visual Studio\\*\\Common?\\IDE\\devenv.exe") and
not (process.parent.executable : "C:\\Program Files (x86)\\InstallShield Installation Information\\*\\setup.exe" and
Target.process.executable : "C:\\Windows\\SysWOW64\\explorer.exe") and
not (process.executable : "C:\\Program Files\\Microsoft Visual Studio\\*\\link.exe" and
process.parent.executable : "C:\\Program Files\\Microsoft Visual Studio\\*\\MSBuild\\*\\Tracker.exe") and
not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
("27fe00d32f773a95e6d50986e5e7499917f66ce881e46054c77652ef4bdf3512",
"a59e039e1520b74254a454bf48c2bceeafe7bd7ac6e5886baa482a52f86a29bf",
"f01bb9aba3f9daf4d8f5551a3b753d8011e16072a1103cf5303d617a9f866424",
"16184cf6f54d6ac4eb0a31c0e9ee8ae775bae6dfdc632e283e832f3e89de595d",
"c983d11ad519a851aca2d37739110b7913819bea1ddf2cc3ec69efe3ed3b609f",
"c3cd2439a6175ce28192904e72b14523b02559d8083a710b5e82aee400626d1a",
"7396f943823494d2ec5f2260329daa2d35b1764f01cdefd95f84ae320986a8f3",
"efd03f2525e69cdc30b5736af74d9485728b8a94d5624da87f1431b3706980ab",
"8eb0721092af3131a940f1e23bc2871e09362980e0b71a7ed7dab6e8accd1f30",
"6edb20df25d1cf0fd1b27052f2604a05db1d7ca5a3f074e7bacc229e28d17667",
"67435999749d9e6908a4029321c0c6f9e915135e98e01a7e499a1c55a960bc68",
"914299dd77f4322c99f62c37df1317ea3424d9a747d4635d10c1d3f003f6abd4",
"51b63860fd996d6d5b1753ba6bb7f3a4303f13187fbfecc96ba2b6bae52a7410",
"0255b5bf7ad66aa090be145f0ad41a0f4e33409ff5c2970081fccd863c720779",
"925a5cd982933bae1b271e1aaaa887ab469397701cd299f4397ddd8af5a351f9",
"9cb1208f1747963dc57e8bf8a8fe82b3aaa856caae3d151b6a6b97b23369f5a6",
"681303f5b5688075b5b504819d8b3c343c78e3240a3bccf371e03228970ffb10",
"30b59303bec45b020b4878b2d33d63bd719d89820456a7ee0a920178efe089f4",
"8ee5bd6fea98577bd29c15055e96ec17c62ca415f4a5d26065b25a922b19d3b1",
"57854d83b50ff0a23d47c077d6da875874ea78f88f28168d8e99ffbf9f1c3153",
"c4788275a5ed2c1576e69b59e6e267ce573450ff07e54b799ec4c4edef40b502",
"a4637935f895de601850c6868d952977a84076a7b1719d0deb519f1fc0871be4",
"a99ac2554c1e392ffe3cd53f7f72f76638948533795fc04f7e15454c386b7eec",
"b031da6137f9442a6cc9f4b4546b4057b666726cb7c9224c4ca857a60f2ec1e1",
"586d8eeaec3a439978836a512bf2f5a987cbe2ba72e5bb10322d04cd65fe8d09",
"ebdc2c2cedd5e549ba8d5e3f474d29204e1cf073e2b26e75f60bb429d2b5a088",
"80eb757f729a943ff0919df1eb980b80f8419f76648407834d95c76adfd21624",
"e71eb30f24c82bc4fa1c645eecbe343f5a44526043fc3a13047183dac5f212f3",
"c46f9f3c710ff2baabea480670220e0328e7bcc2aa3c598c3f982728e0b5652d",
"7f1ab7572a89534366172df3ae5f0182aab1ae3ef992b684a84c5c1a10e8315f",
"d7624e57820ccd1bae7881e08af40bc3522971278018fdfbe0ca98302292165c",
"e0f11ad44d1c1e11f9308f9aaee4d8bcac86ff6e0b4a41d1e75879f6cfd56049",
"2266a567ba921d1c2661258cd5b31150274cb781ac01413c34a471557123ba65",
"1f2e936a57994e16b457f249a64af4786877f7beaab003fb521a20e45031f408",
"e8eaf74988082b8c8222dabed68218069c8eb4e93acd3619a776bc28d39e5ce5",
"39fdb47a5f349e06bbb7dc1cedcc81a051d1dffe373956871325f8327e858afa",
"f7af5eac1d34a2ddc619dd0c3172ec28334b8d79efc1f8ad758124b7e5aae0d5",
"8f3d19065d0d1295bbfbf7591aa02af3a5dc70fde74bac670c18ccd8f7306008",
"d6b771bedda261bcfe9dd1d1402b7d33b5cd2764cd53d941957e32920cfbeb19",
"3e02857de5a59331e1f7fc7e1ddf5ae58e8680d298bb44b49bd316e0b3a1f024",
"954b4385cf4faecfbf9cd04e01c059eb09113a78ee727149b63a65b495a28a6c",
"8851b734602eb00da5b1cfc1e40d38f1cb32e0add2df257ff9d7dbd520b4d5da",
"b2d86212afab00e7b9bf19b7931277130b653c9258ac419a7a24d749471ea5ac",
"5231df995d71991ee4108937bb12e4d3f344a96fb0c4cd82c14e18061d6c4730",
"4daef5be9503c580697b36b0b60a702c109e23840c0632ca00ef4a233603018e",
"fd788a077e026905f1565e0d2a65dfc6c55699c098a59879d6b0b3f3b8459ae8",
"dc641636d5d782b31d29ce823e951d1a2164c86ee06bf2f65a841360fb7af356",
"fb4a05ce7d50721c71f66c37e0ab7e52cd46034a2e394940b3f60c9c2afb079a",
"862a7e8c68f05b91ecf3a43ac5b60c6f57ee50fa98ad1b539480d541628f5c2e",
"44c87532cbb511c369b38a105fc5a84b1d89dba9dfdd5a62c311d6176fe93201",
"465aade5769d4cae2ca1f365ca634440a0444ca0ce319171c140c362d12859c4",
"d615af8e012426c8847c750a0838159d6c41385d2e50388cea28a97999b81614",
"9c63bfc10af9e801f0a009cb5e3c3c097d5eae8ee00351e2bcaa672ead352df4",
"8bca3967254a38d6789c90afe136e34e96b5840b3fc77826dcf3c73b44016ea2",
"dc2d5b2d59a18cd4e749d2cd709e4ada3751ef59d188a8bbab1bbd7562f2d609",
"759f7e4d46e10d3de2fad228994ae8bb142ff171082d175b5d233895efa047be",
"bea84d6541a56c63c570d7b637d18b4de3348c6f8b96b536002da1e7c268879f",
"bc66341f3d2cd4d5216612869731a9f653fa4d75b429ee944a0802ae9457367f",
"5497ff34548a2a0c948024e0d4f21005c18f82ed01246ee98dbb33c0389670c8",
"ebbc8af232a86e870ecf0cbb3f6c3dc79e740c14e907437bab449e2a1e098ed3",
"f3cb863c2a8f16a5f1a4ec5a4d7036f7a0b444cbd4f52226c0d463154e8d5428",
"646c951524f1fab3aaa70a4cff9469ab658a2a0bdeea4e88aa18072c54c83430",
"c79d56dacc8e28b662dcc5fe922453d225441bfa73656942beb205bf4ad20066",
"d0735ca28e1f806da75e83a8405ed431d991c7476bc79c8be6c7b27ccce0ac31",
"175184977cf02e59af9674a24a2f2b0d8278bf886f9f7e05ef8878b5364dc3bb",
"7214d926419fe847a4795a74f9b73209990e4927bb5b56128cf30703be68cde7",
"f7c78dba07128af325d8da99138ebf78be163ecfb5da5b01fa6b65b96efecef1",
"5bcb5bd390665792c5e597bcc569caa9bfb942ef7946014eb60dcef0fcf586a6",
"07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a",
"3d171205aec848f93b721891806ff86b36ba639923067f6e5dabc4cf500f5831",
"7b55a781fef86de1dd56f8956b5160d74de10c9c9179e7f5b38331eb4eefd9af",
"593384d6a5d77c75426c0fe7d93663d24e9797548dd52ff8d60f9c25ac0b70f9",
"67fffdf1b96050f8eca6e844cb23fcee2ef54f85fbfb7786ad9d6d3c39d84415",
"e3fdcd2b4c5215e74b0cabe91ce7fe2800cbf8e2a28157342960bca61bbd6b5d",
"bd6843726688bd7253a42180bf95671ad5b0f9e787adb4f13250f484abd9eae4",
"4f1f25bb19905c34bf75436d32c48df96afd9872c0f5fc5ab45e31f9783e1ace",
"0d6ff0e37139ee86d2991d2b8389f36316778ddb6e44a6d6c727e2d4b87693a5",
"6e54f990149523e9b25c4dd804986f55bdbf846ba1261f8a0ba285cdfabe0bab",
"2c8483ea06618e3c501678e4b7bd77f2e1c068cfa88c0f168abffa5f78b328ea",
"03e03d5726da2ca346a0130cf01b7fa4af46b5f8b9370d1cf63ddde1c72dd6d2",
"0d6ff0e37139ee86d2991d2b8389f36316778ddb6e44a6d6c727e2d4b87693a5",
"494ee86d2a538f23fcfbab1507612637b4af2b97166ed1e3b5f86da74506bca4",
"341f3841335bf2e4e2d2fe39672c591fbc819b0b64b654fc198000234fb8052b",
"9840c97b35afb77418d541ef2f1b5da93c0d7d9632c334ec7444ceadeb0f9fa8",
"27f6d804c989ddae14c94768240c639e14fc94bac4a56156c4f1925682004f89",
"ddcbecf2cd2cd4904cf21e3db40c6a918df0ed3b258473fc5d6e2688dee72696",
"4e4b9bcef90731eb9b1306610fc89ba31296a5875ff5ba628f7271130aa61280",
"35e1443640e39922f5488cba77b10fd97a58c65e0c4d2a0dcdd16a276c3677e1",
"b152de9afc373bba831dc9c1b137668462ae6d46ccd46815f2ffcc7f1bfc7056",
"c9b456c3722c60e680e8bbf3a8c9aad55bbea6af0f8de7340e4573b23b1272b6",
"472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c",
"cd4aa919f346bee759d4aded15c57901026307446546f8c296fa706e2e109095",
"e3a6a3337494667a6cfd7578e9a6c6b5f17f4cac82ae9a98d56cd4c2ae701542",
"0884f057877298b3dd93f3ffd749692820f7e8df52f907480484dab5000048f4",
"7291b1c32671f5416ea33d1f14ca6a36dc77e166a12e6a3868ba68b9ebfdc3d3",
"00bf4e4083d79196e54b39e2d957b25b50807c922d3cc09f5661215536895f4b",
"fdef73d692e2e181075bf43a05cd7ebe551f6b1be31f4d471ff709f83a549612",
"6eed2886728608f1b3f4a54a7a7d338ef1b1669f6f53a5d38bcd352f0ec755c9",
"9840c97b35afb77418d541ef2f1b5da93c0d7d9632c334ec7444ceadeb0f9fa8",
"418a7dc57d5ac225d7f012fe90a1668a797fde56c9add6c3aad841ab0c1e2bc1",
"42215642c3c1ec4c578b9c03cbe8cd93cdf20abe33687473da2d25d5f5efe0a9",
"1dfc0c4f5442dcff2082d9258254b6861c27001aada055d960844561e699655b",
"e09a338081b83a42e97b60311d9af749baaedb226b155d9e7bd658de1c5a349d",
"1fa7ef783a81ed730bd40540e0aec4c1b42ba7eef52ddb28311f2086580db766",
"1f8a5ff26f722b380754d794ad4b8d9edf69361e18ea0a2a03ed58d61e91849c",
"c5d10c310306c223b66ebf1595db00d581d4eff1a0615d4d309cd9160f85a008",
"538837e2f9bdb764d6ec799c89348bd483d51e72b3f91b6bc5e30a1bdcae24bf",
"b0fda4dd268633f34e75e03fb0c79ed9512b5fb4ecf7b85989e2b7744f7b7974",
"722cb3292042a573a1f56a535d1986fd8496261ba68e6d60a32599701df617c7",
"615ac4399eed0a26e5cd9bba4e7dcf661400fb0546dce067523fe275351d3b04",
"c750bdf07966a69d1423dda5deb3413d312e319c9dd1193f354eb48310208370",
"d0a62a67891bbd4eb263d328e5bf6da080bcd7d16c3b1d73e563a48263062c5a",
"cd0e1ca821e92ae426cbd30daf44ae3580ec4070c734b2d411376a5e6a874e97",
"ccae2a12091763da594e0ceb83e3aa438bccf2449b2dc91c916232ba2117ae22",
"16bbdb339173d25b4332b377da96e80809aabfe6739cf35d5e70484f08cfdc42",
"d355b62cc7dc5b8f3ee5e95a8ddddc818f6f84c5a16799d78b1cb3d786e2bb80",
"8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe",
"fe04a6ca7c35330dd0adf681aaf85ce9f6342a027c74776ea09e30517e02acd1",
"379952ec8113b3692872ffb9d07c242968ee1edfac9b3b888496c1480033be91",
"4ab37b0f9c5fe3505e1ecfe0764aaa04838cf81f9e0a402425e057f7a251e621",
"ab7ba2df709c5ff7ee16a1038deaf1d795977b035a1ba08cc6d32ea9ff87bd80",
"a6967e7a3c2251812dd6b3fa0265fb7b61aadc568f562a98c50c345908c6e827",
"68a9b8395bc4593deff311046193ef71444767359622538c848363ddb1afb4c0",
"c982aa3d9e2bce5a6faec7a767f58ba6a622f07e7af6ca8abee4eb6b12492574",
"06990109b285c72e65d9f3f803738ee874a4dc9d505f384eee93b7bb6a8cf9b8",
"98c2ddea9b192883eae55567908722a981a1bed1f55ef0b4bacc984530c85292",
"7dc65ca4c511808d59ebf73eb8810cc3e6e62ed7229ac53bd1cce0e6d8f9b60f",
"bb1e5c4b390f31630fa87da5ee2ce326811f3566c58c16b2a68c9cff9c269fb7",
"9344363df85bc76135431e64f3be606355a8c33d6ea9918573b53500537a1f2b",
"809ff63ca16058e93474ada89f45f832aeac705b032004745fd06fe15b4942c3",
"771af46d1e8f21d303cdd81c91206986c40e1671b092e039cea3a7f3d250492a",
"a3800ebd1797b54aded5134cc9b93df3051b1aaa74a619c4a5223d5a1979dce1",
"c729c4b5a6ad8d247acd4b0d32d5a5999647461ee5f565c618b26d339caebbca",
"17aad91089b18cd97d7ddadbe9873cfde18bf3cb998623a8dfd3aa85006ce736",
"e2f9e698b01ea5e525396ddb86d5dbfcf85f6f19d6e9b8e4f1d75cbcd0da626d",
"237e9b49a376436896837ad26bcf3fc7776ec382395bdd99ccf9bc844fe16326",
"426ed7db4bbf0dcc03ce2f27ca844147547a429399e4def018492a0b828775ca",
"b946e5cce23efb43520850c4d24cd03177e62f959341a99d01fdefa17864aad9",
"6ecdd9b65df1281b3df79594064eecec8be0a0f3769caf7ea65031947d9546fb",
"da8a30160ab0fe450cc42aad45999e22ea848ac9a98814d420c4da884e733e22",
"c0106d2c7f43ffb28532537cdfdb0085d2f0de1e595736fd4e62a68670bb15ae",
"0ec1018ec231baee086a680d535847d478dc843adcafcf007f143d6c905637be",
"552bee0c0d9af1399022451accd3fd527fe865428658482196ecf45432f7a235",
"e44286422a2e26d4813dc78e2215a0dd1a074d0fca4c12eb19f532338f714d2b",
"135766eefef4af765ad7f2fcd0b4f72c0d9e8d1364c21a508c0ce66dae294f20",
"0a48fd481cc5901b6a1608b58e55823d77cef5bd2897392f201a450af301292e",
"21d741e2c5089776a535587cd5fcd933b51054e16bf8e50855e74e68b3790228",
"11d174e1e922a8e644bdd2b5287879445cc6ff0117ef553d5ce6390f1bb49cb5",
"69a56fd6a22193044336b1ee6548efcc992ab3e51f617d772a32f5e12cdef998",
"d1c43b02455df6ed98a5c1fe1ac16284706ed4bd76a784c332dd6b2bec90183f",
"ff31fa811f9c07cc7fdaa68c9e8bca3a7b4fdf6e0a079a58175ea58ba139c7ae",
"25fbc88c7c967266f041ae4d47c2eae0b96086f9e440cca10729103aee7ef6cd",
"af3d6298a8cd7293479f77eab032478e766dae44749489b9568c9fa50ce70890",
"ba2616674f60ba0b977900bed95dbfb9fad2ad6084cbf90f831fc06c1bfb2f23",
"12296a09402575cf107cf0c8b87a31716de1f56896f512aab6e6e86e13247350",
"11d87cac25f6d438db6c6dfec631f97fa5f6ad98e7d99fa50ac1479706efb3b5",
"37cf45f320b9bc4ca198bd93ac1f7882756d82f491809ea4f8907c69cfe1c9ae",
"b2c5905e7e7da322d7be5b2a5552c37345f678b9f69c14c630a1bd1186455c1f",
"176d01497ed5abfedd82db3889a0f8f60a8e254fe841d95cda94de20e0dd4b42",
"250c5f755d35a56189c7d557f1ea3b2827f26ff83c563df8a6cedb0114777fc0",
"f3553d5c7a36f67eb9934cc372ded8c2d592ae671ebd4297b0fbfd1cedad4205",
"0740759a6e479b0ff718e00c6f2d5f3c67db2ac31c787d2caa7e683588c23a03",
"4e0421b9849e2f873399832c44c1e858eef3dc37ac2ccd6dcb340ad35dfab63a",
"cb7ab3788d10940df874acd97b1821bbb5ee4a91f3eec11982bb5bf7a3c96443",
"5b6929aaaa7bd05bcaa5baa7ce8c4243804d6989f1c97ca44726ed124b49e9bb") and
not (process.executable : "C:\\Program Files (x86)\\Microsoft Visual Studio*\\bin\\lib.exe" and
Target.process.executable : "C:\\Program Files (x86)\\Microsoft Visual Studio*.exe" and process.thread.Ext.call_stack_final_user_module.name == "qt5xml.dll")
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
process.thread.Ext.call_stack_final_user_module.code_signature | array_any | excludes:process.thread.Ext.call_stack_final_user_module.code_signature | |
process.Ext.api.parameters.size | le | 140 | excludes:process.Ext.api.parameters.size field:"process.Ext.api.parameters.size" value:"140" |
process.name | eq | rundll32.exe | excludes:process.name field:"process.name" value:"rundll32.exe" |
process.thread.Ext.call_stack | array_any | excludes:process.thread.Ext.call_stack | |
process.Ext.api.summary | match | PEB, PEB32, ProcessStartupInfo | excludes:process.Ext.api.summary field:"process.Ext.api.summary" value:"PEB" field:"process.Ext.api.summary" value:"PEB32" field:"process.Ext.api.summary" value:"ProcessStartupInfo" |
Target.process.executable | eq | C:\Windows\SysWOW64\explorer.exe | excludes:Target.process.executable field:"Target.process.executable" value:"C:\Windows\SysWOW64\explorer.exe" |
process.Ext.api.metadata.target_address_name | eq | Unbacked | excludes:process.Ext.api.metadata.target_address_name field:"process.Ext.api.metadata.target_address_name" value:"Unbacked" |
process.Ext.api.parameters.size | lt | 3200 | excludes:process.Ext.api.parameters.size field:"process.Ext.api.parameters.size" value:"3200" |
process.parent.executable | wildcard | C:\Program Files (x86)\InstallShield Installation Information\*\setup.exe | excludes:process.parent.executable field:"process.parent.executable" value:"C:\Program Files (x86)\InstallShield Installation Information\*\setup.exe" |
Target.process.executable | wildcard | C:\Program Files (x86)\Microsoft Visual Studio*.exe | excludes:Target.process.executable field:"Target.process.executable" value:"C:\Program Files (x86)\Microsoft Visual Studio*.exe" |
process.executable | wildcard | C:\Program Files (x86)\Microsoft Visual Studio*\bin\lib.exe | excludes:process.executable field:"process.executable" value:"C:\Program Files (x86)\Microsoft Visual Studio*\bin\lib.exe" |
process.thread.Ext.call_stack_final_user_module.name | eq | qt5xml.dll | excludes:process.thread.Ext.call_stack_final_user_module.name field:"process.thread.Ext.call_stack_final_user_module.name" value:"qt5xml.dll" |
process.thread.Ext.call_stack_summary | wildcard | ntdll.dll|*Unknown* | excludes:process.thread.Ext.call_stack_summary field:"process.thread.Ext.call_stack_summary" value:"ntdll.dll|*Unknown*" |
process.executable | wildcard | C:\Program Files\Microsoft Visual Studio\*\Common?\IDE\devenv.exe | excludes:process.executable field:"process.executable" value:"C:\Program Files\Microsoft Visual Studio\*\Common?\IDE\devenv.exe" |
process.thread.Ext.call_stack_final_user_module.name | eq | mscordbi.dll | excludes:process.thread.Ext.call_stack_final_user_module.name field:"process.thread.Ext.call_stack_final_user_module.name" value:"mscordbi.dll" |
process.executable | wildcard | C:\Program Files\Microsoft Visual Studio\*\link.exe | excludes:process.executable field:"process.executable" value:"C:\Program Files\Microsoft Visual Studio\*\link.exe" |
process.parent.executable | wildcard | C:\Program Files\Microsoft Visual Studio\*\MSBuild\*\Tracker.exe | excludes:process.parent.executable field:"process.parent.executable" value:"C:\Program Files\Microsoft Visual Studio\*\MSBuild\*\Tracker.exe" |
process.executable | wildcard | \\?\Volume{*}\*.exe, \\?\Volume{*}\*.exe | excludes:process.executable field:"process.executable" value:"\\?\Volume{*}\*.exe" field:"process.executable" value:"\\?\Volume{*}\*.exe" |
process.thread.Ext.call_stack_final_user_module.path | wildcard | ?:\*\docker\*\windows\*.dll | excludes:process.thread.Ext.call_stack_final_user_module.path field:"process.thread.Ext.call_stack_final_user_module.path" value:"?:\*\docker\*\windows\*.dll" |
process.Ext.api.summary | match | Unknown | excludes:process.Ext.api.summary field:"process.Ext.api.summary" value:"Unknown" |
process.thread.Ext.call_stack_final_user_module.hash.sha256 | in | 00bf4e4083d79196e54b39e2d957b25b50807c922d3cc09f5661215536895f4b, 0255b5bf7ad66aa090be145f0ad41a0f4e33409ff5c2970081fccd863c720779, 03e03d5726da2ca346a0130cf01b7fa4af46b5f8b9370d1cf63ddde1c72dd6d2, 06990109b285c72e65d9f3f803738ee874a4dc9d505f384eee93b7bb6a8cf9b8, 0740759a6e479b0ff718e00c6f2d5f3c67db2ac31c787d2caa7e683588c23a03, 07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a, 0884f057877298b3dd93f3ffd749692820f7e8df52f907480484dab5000048f4, 0a48fd481cc5901b6a1608b58e55823d77cef5bd2897392f201a450af301292e, 0d6ff0e37139ee86d2991d2b8389f36316778ddb6e44a6d6c727e2d4b87693a5, 0ec1018ec231baee086a680d535847d478dc843adcafcf007f143d6c905637be, 11d174e1e922a8e644bdd2b5287879445cc6ff0117ef553d5ce6390f1bb49cb5, 11d87cac25f6d438db6c6dfec631f97fa5f6ad98e7d99fa50ac1479706efb3b5, 12296a09402575cf107cf0c8b87a31716de1f56896f512aab6e6e86e13247350, 135766eefef4af765ad7f2fcd0b4f72c0d9e8d1364c21a508c0ce66dae294f20, 16184cf6f54d6ac4eb0a31c0e9ee8ae775bae6dfdc632e283e832f3e89de595d, 16bbdb339173d25b4332b377da96e80809aabfe6739cf35d5e70484f08cfdc42, 175184977cf02e59af9674a24a2f2b0d8278bf886f9f7e05ef8878b5364dc3bb, 176d01497ed5abfedd82db3889a0f8f60a8e254fe841d95cda94de20e0dd4b42, 17aad91089b18cd97d7ddadbe9873cfde18bf3cb998623a8dfd3aa85006ce736, 1dfc0c4f5442dcff2082d9258254b6861c27001aada055d960844561e699655b, 1f2e936a57994e16b457f249a64af4786877f7beaab003fb521a20e45031f408, 1f8a5ff26f722b380754d794ad4b8d9edf69361e18ea0a2a03ed58d61e91849c, 1fa7ef783a81ed730bd40540e0aec4c1b42ba7eef52ddb28311f2086580db766, 21d741e2c5089776a535587cd5fcd933b51054e16bf8e50855e74e68b3790228, 2266a567ba921d1c2661258cd5b31150274cb781ac01413c34a471557123ba65, 237e9b49a376436896837ad26bcf3fc7776ec382395bdd99ccf9bc844fe16326, 250c5f755d35a56189c7d557f1ea3b2827f26ff83c563df8a6cedb0114777fc0, 25fbc88c7c967266f041ae4d47c2eae0b96086f9e440cca10729103aee7ef6cd, 27f6d804c989ddae14c94768240c639e14fc94bac4a56156c4f1925682004f89, 27fe00d32f773a95e6d50986e5e7499917f66ce881e46054c77652ef4bdf3512, 2c8483ea06618e3c501678e4b7bd77f2e1c068cfa88c0f168abffa5f78b328ea, 30b59303bec45b020b4878b2d33d63bd719d89820456a7ee0a920178efe089f4, 341f3841335bf2e4e2d2fe39672c591fbc819b0b64b654fc198000234fb8052b, 35e1443640e39922f5488cba77b10fd97a58c65e0c4d2a0dcdd16a276c3677e1, 379952ec8113b3692872ffb9d07c242968ee1edfac9b3b888496c1480033be91, 37cf45f320b9bc4ca198bd93ac1f7882756d82f491809ea4f8907c69cfe1c9ae, 39fdb47a5f349e06bbb7dc1cedcc81a051d1dffe373956871325f8327e858afa, 3d171205aec848f93b721891806ff86b36ba639923067f6e5dabc4cf500f5831, 3e02857de5a59331e1f7fc7e1ddf5ae58e8680d298bb44b49bd316e0b3a1f024, 418a7dc57d5ac225d7f012fe90a1668a797fde56c9add6c3aad841ab0c1e2bc1, 42215642c3c1ec4c578b9c03cbe8cd93cdf20abe33687473da2d25d5f5efe0a9, 426ed7db4bbf0dcc03ce2f27ca844147547a429399e4def018492a0b828775ca, 44c87532cbb511c369b38a105fc5a84b1d89dba9dfdd5a62c311d6176fe93201, 465aade5769d4cae2ca1f365ca634440a0444ca0ce319171c140c362d12859c4, 472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c, 494ee86d2a538f23fcfbab1507612637b4af2b97166ed1e3b5f86da74506bca4, 4ab37b0f9c5fe3505e1ecfe0764aaa04838cf81f9e0a402425e057f7a251e621, 4daef5be9503c580697b36b0b60a702c109e23840c0632ca00ef4a233603018e, 4e0421b9849e2f873399832c44c1e858eef3dc37ac2ccd6dcb340ad35dfab63a, 4e4b9bcef90731eb9b1306610fc89ba31296a5875ff5ba628f7271130aa61280, 4f1f25bb19905c34bf75436d32c48df96afd9872c0f5fc5ab45e31f9783e1ace, 51b63860fd996d6d5b1753ba6bb7f3a4303f13187fbfecc96ba2b6bae52a7410, 5231df995d71991ee4108937bb12e4d3f344a96fb0c4cd82c14e18061d6c4730, 538837e2f9bdb764d6ec799c89348bd483d51e72b3f91b6bc5e30a1bdcae24bf, 5497ff34548a2a0c948024e0d4f21005c18f82ed01246ee98dbb33c0389670c8, 552bee0c0d9af1399022451accd3fd527fe865428658482196ecf45432f7a235, 57854d83b50ff0a23d47c077d6da875874ea78f88f28168d8e99ffbf9f1c3153, 586d8eeaec3a439978836a512bf2f5a987cbe2ba72e5bb10322d04cd65fe8d09, 593384d6a5d77c75426c0fe7d93663d24e9797548dd52ff8d60f9c25ac0b70f9, 5b6929aaaa7bd05bcaa5baa7ce8c4243804d6989f1c97ca44726ed124b49e9bb, 5bcb5bd390665792c5e597bcc569caa9bfb942ef7946014eb60dcef0fcf586a6, 615ac4399eed0a26e5cd9bba4e7dcf661400fb0546dce067523fe275351d3b04, 646c951524f1fab3aaa70a4cff9469ab658a2a0bdeea4e88aa18072c54c83430, 67435999749d9e6908a4029321c0c6f9e915135e98e01a7e499a1c55a960bc68, 67fffdf1b96050f8eca6e844cb23fcee2ef54f85fbfb7786ad9d6d3c39d84415, 681303f5b5688075b5b504819d8b3c343c78e3240a3bccf371e03228970ffb10, 68a9b8395bc4593deff311046193ef71444767359622538c848363ddb1afb4c0, 69a56fd6a22193044336b1ee6548efcc992ab3e51f617d772a32f5e12cdef998, 6e54f990149523e9b25c4dd804986f55bdbf846ba1261f8a0ba285cdfabe0bab, 6ecdd9b65df1281b3df79594064eecec8be0a0f3769caf7ea65031947d9546fb, 6edb20df25d1cf0fd1b27052f2604a05db1d7ca5a3f074e7bacc229e28d17667, 6eed2886728608f1b3f4a54a7a7d338ef1b1669f6f53a5d38bcd352f0ec755c9, 7214d926419fe847a4795a74f9b73209990e4927bb5b56128cf30703be68cde7, 722cb3292042a573a1f56a535d1986fd8496261ba68e6d60a32599701df617c7, 7291b1c32671f5416ea33d1f14ca6a36dc77e166a12e6a3868ba68b9ebfdc3d3, 7396f943823494d2ec5f2260329daa2d35b1764f01cdefd95f84ae320986a8f3, 759f7e4d46e10d3de2fad228994ae8bb142ff171082d175b5d233895efa047be, 771af46d1e8f21d303cdd81c91206986c40e1671b092e039cea3a7f3d250492a, 7b55a781fef86de1dd56f8956b5160d74de10c9c9179e7f5b38331eb4eefd9af, 7dc65ca4c511808d59ebf73eb8810cc3e6e62ed7229ac53bd1cce0e6d8f9b60f, 7f1ab7572a89534366172df3ae5f0182aab1ae3ef992b684a84c5c1a10e8315f, 8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe, 809ff63ca16058e93474ada89f45f832aeac705b032004745fd06fe15b4942c3, 80eb757f729a943ff0919df1eb980b80f8419f76648407834d95c76adfd21624, 862a7e8c68f05b91ecf3a43ac5b60c6f57ee50fa98ad1b539480d541628f5c2e, 8851b734602eb00da5b1cfc1e40d38f1cb32e0add2df257ff9d7dbd520b4d5da, 8bca3967254a38d6789c90afe136e34e96b5840b3fc77826dcf3c73b44016ea2, 8eb0721092af3131a940f1e23bc2871e09362980e0b71a7ed7dab6e8accd1f30, 8ee5bd6fea98577bd29c15055e96ec17c62ca415f4a5d26065b25a922b19d3b1, 8f3d19065d0d1295bbfbf7591aa02af3a5dc70fde74bac670c18ccd8f7306008, 914299dd77f4322c99f62c37df1317ea3424d9a747d4635d10c1d3f003f6abd4, 925a5cd982933bae1b271e1aaaa887ab469397701cd299f4397ddd8af5a351f9, 9344363df85bc76135431e64f3be606355a8c33d6ea9918573b53500537a1f2b, 954b4385cf4faecfbf9cd04e01c059eb09113a78ee727149b63a65b495a28a6c, 9840c97b35afb77418d541ef2f1b5da93c0d7d9632c334ec7444ceadeb0f9fa8, 98c2ddea9b192883eae55567908722a981a1bed1f55ef0b4bacc984530c85292, 9c63bfc10af9e801f0a009cb5e3c3c097d5eae8ee00351e2bcaa672ead352df4, 9cb1208f1747963dc57e8bf8a8fe82b3aaa856caae3d151b6a6b97b23369f5a6, a3800ebd1797b54aded5134cc9b93df3051b1aaa74a619c4a5223d5a1979dce1, a4637935f895de601850c6868d952977a84076a7b1719d0deb519f1fc0871be4, a59e039e1520b74254a454bf48c2bceeafe7bd7ac6e5886baa482a52f86a29bf, a6967e7a3c2251812dd6b3fa0265fb7b61aadc568f562a98c50c345908c6e827, a99ac2554c1e392ffe3cd53f7f72f76638948533795fc04f7e15454c386b7eec, ab7ba2df709c5ff7ee16a1038deaf1d795977b035a1ba08cc6d32ea9ff87bd80, af3d6298a8cd7293479f77eab032478e766dae44749489b9568c9fa50ce70890, b031da6137f9442a6cc9f4b4546b4057b666726cb7c9224c4ca857a60f2ec1e1, b0fda4dd268633f34e75e03fb0c79ed9512b5fb4ecf7b85989e2b7744f7b7974, b152de9afc373bba831dc9c1b137668462ae6d46ccd46815f2ffcc7f1bfc7056, b2c5905e7e7da322d7be5b2a5552c37345f678b9f69c14c630a1bd1186455c1f, b2d86212afab00e7b9bf19b7931277130b653c9258ac419a7a24d749471ea5ac, b946e5cce23efb43520850c4d24cd03177e62f959341a99d01fdefa17864aad9, ba2616674f60ba0b977900bed95dbfb9fad2ad6084cbf90f831fc06c1bfb2f23, bb1e5c4b390f31630fa87da5ee2ce326811f3566c58c16b2a68c9cff9c269fb7, bc66341f3d2cd4d5216612869731a9f653fa4d75b429ee944a0802ae9457367f, bd6843726688bd7253a42180bf95671ad5b0f9e787adb4f13250f484abd9eae4, bea84d6541a56c63c570d7b637d18b4de3348c6f8b96b536002da1e7c268879f, c0106d2c7f43ffb28532537cdfdb0085d2f0de1e595736fd4e62a68670bb15ae, c3cd2439a6175ce28192904e72b14523b02559d8083a710b5e82aee400626d1a, c46f9f3c710ff2baabea480670220e0328e7bcc2aa3c598c3f982728e0b5652d, c4788275a5ed2c1576e69b59e6e267ce573450ff07e54b799ec4c4edef40b502, c5d10c310306c223b66ebf1595db00d581d4eff1a0615d4d309cd9160f85a008, c729c4b5a6ad8d247acd4b0d32d5a5999647461ee5f565c618b26d339caebbca, c750bdf07966a69d1423dda5deb3413d312e319c9dd1193f354eb48310208370, c79d56dacc8e28b662dcc5fe922453d225441bfa73656942beb205bf4ad20066, c982aa3d9e2bce5a6faec7a767f58ba6a622f07e7af6ca8abee4eb6b12492574, c983d11ad519a851aca2d37739110b7913819bea1ddf2cc3ec69efe3ed3b609f, c9b456c3722c60e680e8bbf3a8c9aad55bbea6af0f8de7340e4573b23b1272b6, cb7ab3788d10940df874acd97b1821bbb5ee4a91f3eec11982bb5bf7a3c96443, ccae2a12091763da594e0ceb83e3aa438bccf2449b2dc91c916232ba2117ae22, cd0e1ca821e92ae426cbd30daf44ae3580ec4070c734b2d411376a5e6a874e97, cd4aa919f346bee759d4aded15c57901026307446546f8c296fa706e2e109095, d0735ca28e1f806da75e83a8405ed431d991c7476bc79c8be6c7b27ccce0ac31, d0a62a67891bbd4eb263d328e5bf6da080bcd7d16c3b1d73e563a48263062c5a, d1c43b02455df6ed98a5c1fe1ac16284706ed4bd76a784c332dd6b2bec90183f, d355b62cc7dc5b8f3ee5e95a8ddddc818f6f84c5a16799d78b1cb3d786e2bb80, d615af8e012426c8847c750a0838159d6c41385d2e50388cea28a97999b81614, d6b771bedda261bcfe9dd1d1402b7d33b5cd2764cd53d941957e32920cfbeb19, d7624e57820ccd1bae7881e08af40bc3522971278018fdfbe0ca98302292165c, da8a30160ab0fe450cc42aad45999e22ea848ac9a98814d420c4da884e733e22, dc2d5b2d59a18cd4e749d2cd709e4ada3751ef59d188a8bbab1bbd7562f2d609, dc641636d5d782b31d29ce823e951d1a2164c86ee06bf2f65a841360fb7af356, ddcbecf2cd2cd4904cf21e3db40c6a918df0ed3b258473fc5d6e2688dee72696, e09a338081b83a42e97b60311d9af749baaedb226b155d9e7bd658de1c5a349d, e0f11ad44d1c1e11f9308f9aaee4d8bcac86ff6e0b4a41d1e75879f6cfd56049, e2f9e698b01ea5e525396ddb86d5dbfcf85f6f19d6e9b8e4f1d75cbcd0da626d, e3a6a3337494667a6cfd7578e9a6c6b5f17f4cac82ae9a98d56cd4c2ae701542, e3fdcd2b4c5215e74b0cabe91ce7fe2800cbf8e2a28157342960bca61bbd6b5d, e44286422a2e26d4813dc78e2215a0dd1a074d0fca4c12eb19f532338f714d2b, e71eb30f24c82bc4fa1c645eecbe343f5a44526043fc3a13047183dac5f212f3, e8eaf74988082b8c8222dabed68218069c8eb4e93acd3619a776bc28d39e5ce5, ebbc8af232a86e870ecf0cbb3f6c3dc79e740c14e907437bab449e2a1e098ed3, ebdc2c2cedd5e549ba8d5e3f474d29204e1cf073e2b26e75f60bb429d2b5a088, efd03f2525e69cdc30b5736af74d9485728b8a94d5624da87f1431b3706980ab, f01bb9aba3f9daf4d8f5551a3b753d8011e16072a1103cf5303d617a9f866424, f3553d5c7a36f67eb9934cc372ded8c2d592ae671ebd4297b0fbfd1cedad4205, f3cb863c2a8f16a5f1a4ec5a4d7036f7a0b444cbd4f52226c0d463154e8d5428, f7af5eac1d34a2ddc619dd0c3172ec28334b8d79efc1f8ad758124b7e5aae0d5, f7c78dba07128af325d8da99138ebf78be163ecfb5da5b01fa6b65b96efecef1, fb4a05ce7d50721c71f66c37e0ab7e52cd46034a2e394940b3f60c9c2afb079a, fd788a077e026905f1565e0d2a65dfc6c55699c098a59879d6b0b3f3b8459ae8, fdef73d692e2e181075bf43a05cd7ebe551f6b1be31f4d471ff709f83a549612, fe04a6ca7c35330dd0adf681aaf85ce9f6342a027c74776ea09e30517e02acd1, ff31fa811f9c07cc7fdaa68c9e8bca3a7b4fdf6e0a079a58175ea58ba139c7ae | excludes:process.thread.Ext.call_stack_final_user_module.hash.sha256 |
process.thread.Ext.call_stack_final_user_module.name | in | Kernel, Undetermined, Unknown | excludes:process.thread.Ext.call_stack_final_user_module.name field:"process.thread.Ext.call_stack_final_user_module.name" value:"Kernel" field:"process.thread.Ext.call_stack_final_user_module.name" value:"Undetermined" field:"process.thread.Ext.call_stack_final_user_module.name" value:"Unknown" |
process.thread.Ext.call_stack_final_user_module.path | wildcard | ?:\windows\assembly\nativeimages_*, ?:\windows\winsxs\*.dll, ?:\program files\*, ?:\program files (x86)\*, c:\windows\apppatch\ummon.dll, c:\windows\apppatch\apppatch64\ummon.dll, c:\windows\system32\ctiuser.dll, c:\windows\syswow64\ctiuser.dll, c:\windows\system32\hpzipm12.dll, c:\windows\system32\lsasrv.dll, c:\windows\syswow64\cwbunpls.dll, c:\windows\system32\shsvcs.dll, c:\windows\system32\sxssrv.dll, c:\windows\syswow64\pgpce.dll, c:\windows\system32\hmpalert.dll, c:\windows\system32\cloudap.dll | excludes:process.thread.Ext.call_stack_final_user_module.path |
process.thread.Ext.call_stack_final_user_module.protection_provenance | in | mfehcthe.dll, system.core.ni.dll | excludes:process.thread.Ext.call_stack_final_user_module.protection_provenance field:"process.thread.Ext.call_stack_final_user_module.protection_provenance" value:"mfehcthe.dll" field:"process.thread.Ext.call_stack_final_user_module.protection_provenance" value:"system.core.ni.dll" |
process.thread.Ext.call_stack_final_user_module.protection_provenance_path | starts_with | ?:\program files\, ?:\program files (x86)\, c:\windows\assembly\nativeimages_ | excludes:process.thread.Ext.call_stack_final_user_module.protection_provenance_path field:"process.thread.Ext.call_stack_final_user_module.protection_provenance_path" value:"?:\program files\" field:"process.thread.Ext.call_stack_final_user_module.protection_provenance_path" value:"?:\program files (x86)\" field:"process.thread.Ext.call_stack_final_user_module.protection_provenance_path" value:"c:\windows\assembly\nativeimages_" |
Indicators
These rows show field, operator, and value matches.