Elastic Defend high stable eql

AppleScript Decoded via Base64

Detects when AppleScript is executed followed by the execution of the Base64 binary with the decode option set. Several malware samples have been observed executing base64 encoded AppleScript in order to avoid detection.

View Source

Detection Logic

sequence with maxspan=10s
[process where event.type == "start" and event.action == "exec" and process.parent.name == "osascript" and 
  (process.name in ("bash", "zsh", "sh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and process.args == "-c"] by process.entity_id
[process where event.type == "start" and event.action == "exec" and (process.name in ("bash", "zsh", "sh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish", "base64") or process.name like "tclsh*") and
  process.command_line like~ "*base64*-d*"] by process.parent.entity_id

Field Validations

Loading…

Comments (0)

Loading comments...