Elastic Defend high stable eql

File Downloaded via Curl or Wget to Hidden Directory

This rule detects when the curl or wget command is used to download a file to a writeable hidden directory, such as /tmp, /var/tmp, or /dev/shm. This behavior is used by threat actors to evade detection and may indicate command and control activity.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and (
  (process.name == "wget" and process.args like ("-o", "--output-*") and
   process.args like ("/tmp*/.*", "/var/tmp*/.*", "/dev/shm/*", "-o-")) or
  (process.name == "curl" and process.args in ("--output", "-o") and
   process.args like ("/tmp*/.*", "/var/tmp*/.*", "/dev/shm/*"))
) and not (
  process.parent.executable in (
    "/Tools/aw_api.sh", "tools/dialyzer/run.sh", "/bin/kubectl", "/srv/kube-proxy-run", "/srv/kubelet/run",
    "/usr/bin/makepkg"
  ) or
  process.parent.executable like ("/run/containerd/*", "/tmp/.mount_vagran*/usr/bin/ruby") or
  process.parent.command_line in ("bash /usr/bin/maldet -u", "runc init") or
  process.command_line like (
    "*/tmp/.dialyzer_analysis*", "*.ansible*", "curl -s https://gist.githubusercontent.com/*bashrc_downlord",
    "*github.com/prefix-dev/pixi*", "*heroku-java-metrics-agent*"
  ) or
  process.args like (
    "https://release-registry.services.sentry.io/apps/sentry-cli/*package=sentry-cli",
    "https*github*astral-sh/rye/*",
    "https://github.com/codecrafters-io/*"
  ) or
  process.working_directory like ("/tmp/wbrashear/easybuild/*", "/var/tmp/pamac-build-*")
)

Field Validations

Loading…

Comments (0)

Loading comments...