Elastic Defend high stable eql

Empire Stager Execution

Identifies when a script interpreter executes a base64-encoded Empire stager. Empire is penetration testing software that is often utilized by attackers.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and
process.name like ("python*", "osascript", "sh", "bash", "dash", "ksh", "tcsh", "zsh") and
process.command_line like~ "*exec(base64.b64decode*aW1wb3J0IHN5cztpbXBvcnQg*"

Field Validations

Loading…

Comments (0)

Loading comments...