Elastic Defend high stable eql

Decoy Document Creation via Curl

Detects when Curl is seen creating a .pdf or .doc file in a suspicious directory like /tmp or /users/shared. A recent DPRK sample was seen downloading a decoy document via Curl like this.

View Source

Detection Logic

sequence by process.entity_id with maxspan=1m
[process where event.type == "start" and event.action == "exec" and process.name in ("curl", "nscurl")]
[file where event.action == "modification" and file.path like ("/tmp/*", "/private/tmp/*", "/Users/Shared/*", "/Users/*/Library/*") and
 file.extension in ("pdf", "doc") and process.name in ("curl", "nscurl") and
 not Effective_process.executable like~ (
  "/Applications/Cursor.app/Contents/MacOS/Cursor",
  "/Applications/Codex.app/Contents/MacOS/*",
  "/Applications/ChatGPT.app/Contents/MacOS/ChatGPT",
  "/Applications/Visual Studio Code.app/Contents/MacOS/Code",
  "/Users/*/Library/Application Support/Claude/claude-code/*/claude.app/Contents/MacOS/claude",
  "/Applications/Visual Studio Code.app/Contents/MacOS/Electron",
  "/Users/*/.local/share/claude/versions/*"
) and not 
(Effective_process.executable like "/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word" and 
  file.path like "/Users/*/Library/Containers/com.microsoft.Word/Data/tmp/Content.MSO/*") and 
 not file.path like "/private/tmp/claude*"]

Field Validations

Loading…

Comments (0)

Loading comments...