Skip to content

Instantly share code, notes, and snippets.

@Samirbous

Samirbous/ES|QL Masquerading as MS Native DLL

Created November 9, 2023 18:55
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 2 You must be signed in to fork a gist
  • Save Samirbous/94651b743d936eb2eddbac597a15aa00 to your computer and use it in GitHub Desktop.
Save Samirbous/94651b743d936eb2eddbac597a15aa00 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
ES|QL Masquerading as MS Native DLL
// DLLs normally located in system32 but unsigned and loaded from elsewhere
// https://www.elastic.co/guide/en/elasticsearch/reference/master/esql-enrich-data.html
// example ENRICH libs-policy creation steps
https://gist.github.com/Samirbous/9f9c3237a0ada745e71cc2ba3425311c
ES|QL query:
from .ds-logs-endpoint.events.library-*
| where event.action == "load" and process.code_signature.status == "trusted" and dll.code_signature.status != "trusted" and
not dll.path rlike """[c-fC-F]:\\Windows\\(System32|SysWOW64)\\[a-zA-Z0-9_]+.dll"""
| ENRICH enrich-dll1
| where native == "yes" and not dll.path like "?:?Windows?assembly?NativeImages*"
| eval process_path = replace(process.executable, "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}", ""), dll_path = replace(dll.path, "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}", "")
| stats cc = count(*) by dll.name, process_path, dll_path
| sort cc desc
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment