Elastic Defend high stable eql

Initial Access Discovery via Applet Executable

Detects the execution of a system or user discovery command via a compiled Apple script binary Applet.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and 
 (process.Ext.effective_parent.name == "applet" or process.parent.name == "applet") and 
 process.name in ("whoami", "sw_vers", "arch", "uname")

Field Validations

Loading…

Comments (0)

Loading comments...