Suspicious Process Access via Direct System Calledit

Identifies suspicious process access events from unknown memory region. Endpoint security solutions usually hook userland Windows APIs in order to decide if the code that is being executed is malicious or not. It’s possible to bypass hooked functions by writing malicious functions that call syscalls directly.

Rule type: eql

Rule indices:

  • winlogbeat-*
  • logs-windows.*

Severity: high

Risk score: 73

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Host
  • Windows
  • Threat Detection
  • Defense Evasion

Version: 1

Added (Elastic Stack release): 7.16.0

Rule authors: Elastic

Rule license: Elastic License v2

Rule queryedit

process where event.code == "10" and
length(winlog.event_data.CallTrace) > 0 and /* Sysmon CallTrace
starting with unknown memory module instead of ntdll which host
Windows NT Syscalls */ not winlog.event_data.CallTrace :
("?:\\WINDOWS\\SYSTEM32\\ntdll.dll*",
"?:\\WINDOWS\\SysWOW64\\ntdll.dll*")

Threat mappingedit

Framework: MITRE ATT&CKTM