Elastic Defend high stable eql

Hidden Process Execution followed by Network Connection

Detects when a hidden process is executed, and initiates an outbound network connection. Threat actors may drop hidden payloads that will later be used to download additional payload stages or tools.

View Source

Detection Logic

sequence by process.entity_id with maxspan=30s
  [process where event.type == "start" and event.action == "exec" and
   process.executable like ("/tmp/.*", "/var/tmp/.*", "/dev/shm/.*") and
   not process.executable like ("/tmp/.ryeinstall*", "/tmp/.sentry*")]
  [network where event.type == "start" and event.action in ("connection_attempted", "connection_accepted") and
   process.name like ".*"]

Field Validations

Loading…

Comments (0)

Loading comments...