Elastic Defend high stable eql

Curl Execution via Env Binary

Detects when curl is executed via the env binary. This is a common technique used by adversaries to avoid standard curl focused detections.

View Source

Detection Logic

sequence by process.parent.entity_id with maxspan=30s
[process where event.type == "start" and process.name == "env" and 
  process.args == "-c" and process.args like~ ("*curl*", "*nscurl*")]
[process where event.type == "start" and 
  process.name in ("bash", "sh", "zsh") and
  process.args == "-c" and process.args like~ ("*curl*", "*nscurl*")]
[process where event.type == "start" and process.name in ("curl", "nscurl") and
  not process.parent.executable like ("/Library/Developer/*", "/opt/homebrew/Cellar/*", "/Applications/Xcode.app/Contents/Developer/usr/bin/make")]

Field Validations

Loading…

Comments (0)

Loading comments...