Elastic Defend high stable eql
Execution of a File Dropped by OpenSSL
Identifies when the OpenSSL utility creates a file followed by its execution. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.
Detection Logic
sequence with maxspan=1m
[file where event.action != "deletion" and process.name == "openssl"] by file.path
[process where event.action == "exec"] by process.executableField Validations
Loading…
Comments (0)
Loading comments...