Elastic Defend high stable eql

Executable File Access or Modification via Osascript

Detects when a executable file is accessed or modified by Osascript on macOS. This activity should be considered malicious or highly suspicious and is indicative of initial access or tool ingress.

View Source

Detection Logic

file where event.action != "deletion" and 
 file.Ext.header_bytes like~ ("cffaedfe*", "cafebabe*") and
 process.name == "osascript"

Field Validations

Loading…

Comments (0)

Loading comments...