Elastic Defend high stable eql

Dylib Load via SSH-Keygen

Detects when the ssh-keygen binary is executed with the -D argument which can be used to load a malicious dylib into memory.

View Source

Detection Logic

process where event.type == "start" and process.name == "ssh-keygen" and process.args == "-D"

Field Validations

Loading…

Comments (0)

Loading comments...