Elastic Defend high stable eql

Abnormally Large Javascript Evaluation via Nodejs

Detects when an abnormally large amount of JavaScript is supplied to Node.js for execution via the evaluate flag. This behavior has been observed in DPRK-attributed malware campaigns.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and process.name == "node" and process.args == "node" and
 process.args == "-e" and process.args_count == 3 and process.command_line == null and process.parent.name == "node"

Field Validations

Loading…

Comments (0)

Loading comments...