Elastic Defend high stable eql

Execution of Non-Executable File via Shell

Detects the execution of an un-executable file, per file extension, via a shell interpreter. Sometimes threat actors will masquerade their payloads as non-executable files in order to avoid suspicion and go unnoticed.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and 
 (process.name in ("bash", "sh", "zsh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and
 process.command_line like ("/bin/bash *", "/bin/sh *", "/bin/zsh *", "/bin/dash *", "/bin/csh *", "/bin/tcsh *", "/bin/ksh *", "/bin/tclsh*", "/bin/fish *",
                            "/usr/bin/bash *", "/usr/bin/sh *", "/usr/bin/zsh *", "/usr/bin/dash *", "/usr/bin/csh *", "/usr/bin/tcsh *", "/usr/bin/ksh *", "/usr/bin/tclsh*", "/usr/bin/fish *",
                            "/usr/local/bin/bash *", "/usr/local/bin/sh *", "/usr/local/bin/zsh *", "/usr/local/bin/dash *", "/usr/local/bin/csh *", "/usr/local/bin/tcsh *", "/usr/local/bin/ksh *", "/usr/local/bin/tclsh*", "/usr/local/bin/fish *",
                            "/opt/homebrew/bin/bash *", "/opt/homebrew/bin/sh *", "/opt/homebrew/bin/zsh *", "/opt/homebrew/bin/dash *", "/opt/homebrew/bin/csh *", "/opt/homebrew/bin/tcsh *", "/opt/homebrew/bin/ksh *", "/opt/homebrew/bin/tclsh*", "/opt/homebrew/bin/fish *") and
 process.command_line like ("*.pid", "*.plist", "*.txt", "*.json", "*.tmp", "*.bin", "*.js", "*.nib", "*.log", "*.dat") and
 process.args_count == 2

Field Validations

Loading…

Comments (0)

Loading comments...