Elastic Defend high stable eql

Elastic Endpoint Security Kernel Extension Unload

Identifies attempts to unload the Elastic Endpoint Security kernel extension via the kextunload command.

View Source

Detection Logic

process where event.type == "start" and
 process.name == "kextunload" and process.args like~ ("*.EndpointSecurity", "EndpointSecurity.kext")

Field Validations

Loading…

Comments (0)

Loading comments...