Skip to content

Instantly share code, notes, and snippets.

@Samirbous

Samirbous/ES|QL Native DLL Hijack

Created November 9, 2023 18:47
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Samirbous/f14ec4cc102f6f879052430da76f6b4b to your computer and use it in GitHub Desktop.
Save Samirbous/f14ec4cc102f6f879052430da76f6b4b to your computer and use it in GitHub Desktop.
Download ZIP
Raw
ES|QL Native DLL Hijack
// DLLs normally located in system32 but unsigned and loaded from elsewhere
// https://www.elastic.co/guide/en/elasticsearch/reference/master/esql-enrich-data.html
// example ENRICH libs-policy creation steps
https://gist.github.com/Samirbous/9f9c3237a0ada745e71cc2ba3425311c
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment