Elastic Defend high stable eql
Arbitrary Python Code Execution via Nodejs
Detects the execution of arbitrary Python code via Nodejs.
Detection Logic
process where event.type == "start" and event.action == "exec" and process.name like~ "python*" and process.args == "-c" and
(process.parent.name == "node" or process.Ext.effective_parent.name == "node") and
process.command_line : ("*os.system*", "*subprocess.run*", "*subprocess.Popen*", "*exec(*", "*eval(*") Field Validations
Loading…
Comments (0)
Loading comments...