Elastic Defend high stable eql

Abnormal Auval Child Process Execution

Detects the execution of a process that should not be executed by the native auval or auvaltool binaries. This activity may occur after a threat actor loads a malicious audio unit plug-in via auval or auvaltool providing them unsigned code execution in the context of those binaries.

View Source

Detection Logic

process where event.type == "start" and (process.parent.name in ("auval", "auvaltool") or
 process.Ext.effective_parent.name in ("auval", "auvaltool")) and
 process.name like~ ("curl",
                    "nscurl", 
                    "osascript", 
                    "bash", 
                    "sh", 
                    "zsh", 
                    "python*") and 
 not process.command_line like ("/Applications/Logic Pro X.app/Contents/MacOS/Logic Pro X", "/Applications/Logic Pro.app/Contents/MacOS/Logic Pro") and
 not process.Ext.effective_parent.executable like ("/Applications/Logic Pro X.app/Contents/MacOS/Logic Pro X", "/Applications/Logic Pro.app/Contents/MacOS/Logic Pro")

Field Validations

Loading…

Comments (0)

Loading comments...