edr:elastic-defend library
library
Stands in for win:sysmon 7 (full)
- Log source
- Elastic Defend endpoint events
- Host type
- EDR sensors (product telemetry, cross-platform)
- How to enable
- Elastic Agent with the Elastic Defend integration; datasets logs-endpoint.events.*.
- Tier, host type
- Minimum
- Techniques
- 0
- Rules depending on it
- Elastic 35
Why this tier
ATT&CK via equivalence to win:sysmon 7
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstationEDR path | Minimum | |
| Windows member serverEDR path | Minimum | |
| Windows domain controllerEDR path | Minimum | |
| Windows web server (IIS), internet-facingEDR path | Minimum | |
| Linux serverEDR path | Minimum | |
| Linux web server, internet-facingEDR path | Minimum | |
| macOS endpointEDR path | Minimum |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
Elastic 35
- Compression DLL Loaded by Unusual Process
- Dylib Injection via Process Environment Variables
- Elastic Defend Alert Followed by Telemetry Loss
- Expired or Revoked Driver Loaded
- First Time Seen Driver Loaded
- Image Loaded with Invalid Signature
- Outbound Scheduled Task Activity via PowerShell
- Potential Command and Control via Internet Explorer
- Potential Credential Access via Trusted Developer Utility
- Potential Enumeration via Active Directory Web Service
- Potential Masquerading as System32 DLL
- Potential Masquerading as VLC DLL
- Potential Windows Session Hijacking via CcmExec
- Remote XSL Script Execution via COM
- Scheduled Task Created by a Windows Script
- Suspicious DLL Loaded for Persistence or Privilege Escalation
- Suspicious Image Load (taskschd.dll) from MS Office
- Suspicious Module Loaded by LSASS
- Suspicious PowerShell Engine ImageLoad
- Suspicious RDP ActiveX Client Loaded
- Suspicious Script Object Execution
- Suspicious SolarWinds Web Help Desk Java Module Load or Child Process
- Suspicious WMI Image Load from MS Office
- Suspicious WMIC XSL Script Execution
- Unsigned BITS Service Client Process
- Unsigned DLL Loaded by Svchost
- Unsigned DLL Loaded by a Trusted Process
- Unsigned DLL Side-Loading from a Suspicious Folder
- Unsigned DLL loaded by DNS Service
- Untrusted DLL Loaded by Azure AD Connect Authentication Agent
- Untrusted Driver Loaded
- Unusual Library Load via Python
- Veeam Backup Library Loaded by Unusual Process
- WPS Office Exploitation via DLL Hijack
- Windows Script Interpreter Executing Process via WMI