Elastic Defend high stable eql
Hidden Folder or File Access in Tmp via Python
Detects possible Python based malware that stage their files in a hidden directory or file that sits within the tmp directory. This rule looks for Python executions where the process arguments include references to hidden folders or files in the tmp directory.
Detection Logic
process where event.type == "start" and
(process.parent.name like~ "python*" or process.Ext.effective_parent.name like~ "python*") and
(process.name in ("mkdir", "osascript", "sh", "bash", "zsh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and
process.args like ("/tmp/.*", "/private/tmp/.*") and
process.args_count == 2Field Validations
Loading…
Comments (0)
Loading comments...