Elastic Defend high stable eql

Information Stealer Collection via Find

Detects when the find command is used to search for files followed by the creation or modification of text files, indicating potential automated collection of sensitive information. This technique is commonly observed in npm typosquatting attacks and information stealers where adversaries use find to locate specific files and then aggregate the results into text files for staging before exfiltration. The find command with file type filters allows attackers to efficiently enumerate and collect target files across the filesystem.

View Source

Detection Logic

sequence by process.entity_id with maxspan=10s
  [process where event.type == "start" and event.action == "exec" and process.name == "find" and
    process.args like "/Users/*/Library/Application Support/*" and process.args == "-type" and process.args == "f"]
  [file where file.extension == "txt" and Effective_process.executable != "/Library/Elastic/Endpoint/elastic-endpoint.app/Contents/MacOS/elastic-endpoint"]

Field Validations

Loading…

Comments (0)

Loading comments...