Elastic Defend high stable eql

Execution from a Password Protected Self Extracting Archive

Identifies the execution of a file from a password protected self-extracting archive. Adversaries may encapsulate malicious code in a protected archive to potentially bypass security controls.

View Source

Detection Logic

sequence with maxspan=1m
  [file where event.action : "creation" and file.name : "*_sfx_access_check*"] by process.entity_id
  [process where event.action : "start" and
   process.parent.args : "-p*" and process.parent.args : "-d*"] by process.parent.entity_id

Field Validations

Loading…

Comments (0)

Loading comments...