Elastic Defend high stable eql

Bind Shell via Socket

Detects the creation of a bind shell via socket. Attackers may spawn bind shells to establish persistence onto a target system.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and process.name == "socket" and
process.args : "-*s*" and process.args : "-*p*" and process.args : "*sh*" and process.args_count >= 3

Field Validations

Loading…

Comments (0)

Loading comments...