Elastic Defend high stable eql

Base64 Encoded String Execution via Osascript

Detects when Osascript executes AppleScript containing a base64 encoded string. Many stealer samples execute AppleScript and some encode the script using base64 in order to avoid detection.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and process.name == "osascript" and
 process.args == "-e" and
 process.args regex~ """.*[A-Za-z0-9\+\/]{30,}\={0,2}.*""" and 
 process.command_line : "*base64*" and
 not process.parent.code_signature.team_id == "9BNSXJN65R" and
 not process.Ext.effective_parent.executable like "/Applications/Docker.app/Contents/MacOS/com.docker.backend"

Field Validations

Loading…

Comments (0)

Loading comments...