Elastic has Process Tampering detections

[jdu2600]

Description

Elastic Defend has Process Tampering fields in its events.

The relevant field is -

• dll.Ext.defense_evasions

References -

• https://www.elastic.co/blog/process-ghosting-a-new-executable-image-tampering-attack
• https://www.elastic.co/blog/detect-block-unknown-knowndlls-windows-acl-hardening-attacks-cache-poisoning-escalation