Elastic Defend high stable eql

Bind Shell via Node

Detects the creation of a bind shell via Node. Attackers may spawn bind shells to establish persistence onto a target system.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and process.name == "node" and
process.args == "-e" and process.command_line : "*spawn*sh*" and process.command_line : "*listen*" and
not (
  process.parent.executable like (
    "*/.local/share/claude/versions/*",
    "*/extensions/anthropic.claude-code-*/resources/native-binary/claude",
    "*/@anthropic-ai/claude-agent-sdk-linux-x64/claude",
    "*/node_modules/@openai/codex-linux-x64/vendor/*/bin/codex",
    "/home/*/.local/zed.app/libexec/zed-editor"
  )
)

Field Validations

Loading…

Comments (0)

Loading comments...