Elastic Defend high stable eql

Dylib Loaded by Process in Suspicious Location

Identifies instances where a dynamic library (dylib) is loaded by a process running from a suspicious or non-standard path on macOS. Threat actors may abuse this technique by using compromised or malicious processes originating from unusual locations to load dylibs for code injection, persistence, or privilege escalation. A dylib loaded from a suspicious process path can indicate that the process itself is malicious, has been tampered with, or is attempting to evade detection by operating from a non-standard location.

View Source

Detection Logic

sequence by process.entity_id with maxspan=10s
[process where event.type == "start" and event.action == "exec" and 
  process.executable like~ ("/var/tmp/*", 
                            "/var/lib/*", 
                            "/tmp/*", 
                            "/var/folders/*",
                            "/Library/Graphics/*",
                            "/Library/Containers/*", 
                            "/Library/Services/*",
                            "/var/root/*", 
                            "/private/var/root/*",
                            "/Library/WebServer/*", 
                            "/Library/Fonts/*")]
[library where event.action == "load" and 
  not dll.code_signature.trusted == true and not
  dll.path like ("/Library/Apple/*", "/private/var/db/oah/*", "/System/Library/*", "/private/var/root/Library/Developer/CoreSimulator/*", 
              "/private/var/root/Library/Caches/ms-playwright/*", "/Library/Developer/*", 
              "/usr/lib/libobjc-trampolines.dylib")]

Field Validations

Loading…

Comments (0)

Loading comments...