Elastic Defend high stable eql

Executable File Modification via SSH

Detects executable file creation or modification via SSH sessions in temporary directories. This indicates potential malware deployment or tool staging by threat actors.

View Source

Detection Logic

file where event.action == "modification" and file.Ext.header_bytes like~ ("cffaedfe*", "cafebabe*") and
 file.path like ("/Users/Shared/*", "/tmp/*", "/private/tmp/*", "/var/tmp/*", "/private/var/tmp/*") and 
 (process.name in ("ssh", "sshd", "sshd-session") or Effective_process.name in ("ssh", "sshd", "sshd-session")) and
 not process.code_signature.subject_name like "Software Signing"

Field Validations

Loading…

Comments (0)

Loading comments...