Process Injection - Detected - Elastic Endgame

Elastic Endgame detected Process Injection. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information.

Elastic rule (View on GitHub)

 1[metadata]
 2creation_date = "2020/02/18"
 3maturity = "production"
 4promotion = true
 5updated_date = "2024/05/21"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Elastic Endgame detected Process Injection. Click the Elastic Endgame icon in the event.module column or the link in the
11rule.reference column for additional information.
12"""
13from = "now-15m"
14index = ["endgame-*"]
15interval = "10m"
16language = "kuery"
17license = "Elastic License v2"
18max_signals = 10000
19name = "Process Injection - Detected - Elastic Endgame"
20risk_score = 73
21rule_id = "80c52164-c82a-402c-9964-852533d58be1"
22setup = """## Setup
23
24This rule is configured to generate more **Max alerts per run** than the default 1000 alerts per run set for all rules. This is to ensure that it captures as many alerts as possible.
25
26**IMPORTANT:** The rule's **Max alerts per run** setting can be superseded by the `xpack.alerting.rules.run.alerts.max` Kibana config setting, which determines the maximum alerts generated by _any_ rule in the Kibana alerting framework. For example, if `xpack.alerting.rules.run.alerts.max` is set to 1000, this rule will still generate no more than 1000 alerts even if its own **Max alerts per run** is set higher.
27
28To make sure this rule can generate as many alerts as it's configured in its own **Max alerts per run** setting, increase the `xpack.alerting.rules.run.alerts.max` system setting accordingly.
29
30**NOTE:** Changing `xpack.alerting.rules.run.alerts.max` is not possible in Serverless projects."""
31severity = "high"
32tags = ["Data Source: Elastic Endgame", "Use Case: Threat Detection", "Tactic: Privilege Escalation"]
33timestamp_override = "event.ingested"
34type = "query"
35
36query = '''
37event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:kernel_shellcode_event or endgame.event_subtype_full:kernel_shellcode_event)
38'''
39
40
41[[rule.threat]]
42framework = "MITRE ATT&CK"
43[[rule.threat.technique]]
44id = "T1055"
45name = "Process Injection"
46reference = "https://attack.mitre.org/techniques/T1055/"
47
48
49[rule.threat.tactic]
50id = "TA0004"
51name = "Privilege Escalation"
52reference = "https://attack.mitre.org/tactics/TA0004/"

Related rules

to-top