Elastic Defend high stable eql

Curl Download and OsaScript Payload Execution via Node

Detects when curl or nscurl is executed as an argument of a shell interpreter via a node parent process. This is a common technique used by malware to download additional payloads and evade traditional defenses.

View Source

Detection Logic

sequence with maxspan=30s
[process where event.type == "start" and process.parent.name == "node" and
 (
  (process.name like~ ("sh", "bash", "zsh", "tclsh*") and
    process.args == "-c" and
    process.args like~ ("curl*", "nscurl*")) or 
  (process.name in ("curl", "nscurl"))
 )] by process.entity_id
[process where event.type == "start" and event.action == "exec" and process.name == "osascript"] by process.parent.entity_id

Field Validations

Loading…

Comments (0)

Loading comments...