Elastic Defend high stable eql

At Job Creation or Modification via Shell Command

Detects the creation or modification of an At job by a suspicious process. This activity should almost never take place as Apple is slowly deprecating it and atrun execution is disabled by default. If this rule fires it should indicate highly abnormal or malicious activity. Threat actors can abuse the atrun scheduler to persist their binaries on a system.

View Source

Detection Logic

sequence by process.entity_id with maxspan=5s
[process where event.type == "start" and (process.name in ("bash", "sh", "zsh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and process.args == "-c"]
[file where event.action != "deletion" and 
  file.path like "/private/var/at/jobs/*" and not
  file.path == "/private/var/at/jobs/root"]

Field Validations

Loading…

Comments (0)

Loading comments...