Elastic Defend high stable eql

Decoded or Decrypted Payload Written to Suspicious Directory

Identifies when the openssl utility is used to decode and/or decrypt a payload and write it to an abnormal or suspicious directory. Malware authors may attempt to evade detection by encoding and/or encrypting their payload. This behavior is consistent with the Bundlore malware family.

View Source

Detection Logic

process where event.action == "exec" and
  ((process.name == "openssl" and process.args like~ "-out" and process.args like~ "enc" and process.args in ("-d", "-base64") and
    process.args like~ ("/tmp/*", 
                        "/Users/*/.*",
                        "/Applications/*/.*",
                        "/private/tmp/*", 
                        "/var/tmp/*", 
                        "/var/folders/*", 
                        "/Users/Shared/*",
                        "/Library/Graphics/*",
                        "/Users/*/Library/Preferences/*",
                        "/Users/*/Library/Services/*", 
                        "/Library/Containers/*", 
                        "/var/root/*", 
                        "/var/lib/*",
                        "/Library/WebServer/*",
                        "/Library/Fonts/*")) or 
   (process.name == "base64" and process.args == "-d" and 
    process.args like~ ("/tmp/*", 
                        "*/.*",
                        "/private/tmp/*", 
                        "/var/tmp/*", 
                        "/var/folders/*", 
                        "/Users/Shared/*", 
                        "/Library/Graphics/*",
                        "/Users/*/Library/Preferences/*",
                        "/Users/*/Library/Services/*", 
                        "/Library/Containers/*", 
                        "/var/root/*", 
                        "/var/lib/*",
                        "/Library/WebServer/*",
                        "/Library/Fonts/*")))

Field Validations

Loading…

Comments (0)

Loading comments...