A newer version is available. For the latest information, see the current release documentation.
« Suspicious PrintSpooler Service Executable File Creation Suspicious Process Execution via Renamed PsExec Executable »
Elastic Docs ›Elastic Security Solution [7.17] ›Detections and alerts ›Prebuilt rule reference

Suspicious Process Access via Direct System Call

edit

Suspicious Process Access via Direct System Call

edit

Identifies suspicious process access events from unknown memory region. Endpoint security solutions usually hook userland Windows APIs in order to decide if the code that is being executed is malicious or not. It’s possible to bypass hooked functions by writing malicious functions that call syscalls directly.

Rule type: eql

Rule indices:

  • winlogbeat-*
  • logs-windows.*

Severity: high

Risk score: 73

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Host
  • Windows
  • Threat Detection
  • Defense Evasion

Version: 1

Added (Elastic Stack release): 7.16.0

Rule authors: Elastic

Rule license: Elastic License v2

Rule query

edit
process where event.code == "10" and
length(winlog.event_data.CallTrace) > 0 and /* Sysmon CallTrace
starting with unknown memory module instead of ntdll which host
Windows NT Syscalls */ not winlog.event_data.CallTrace :
("?:\\WINDOWS\\SYSTEM32\\ntdll.dll*",
"?:\\WINDOWS\\SysWOW64\\ntdll.dll*")

Threat mapping

edit

Framework: MITRE ATT&CKTM

« Suspicious PrintSpooler Service Executable File Creation Suspicious Process Execution via Renamed PsExec Executable »