Elastic Defend high stable eql

Arbitrary Python Code Execution via Nodejs

Detects the execution of arbitrary Python code via Nodejs.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and process.name like~ "python*" and process.args == "-c" and 
 (process.parent.name == "node" or process.Ext.effective_parent.name == "node") and
 process.command_line : ("*os.system*", "*subprocess.run*", "*subprocess.Popen*", "*exec(*", "*eval(*")

Field Validations

Loading…

Comments (0)

Loading comments...