Elastic Defend high stable eql

Initial Access via OSA Shell Script Piped to Python Interpreter

Detects when an Osascript shell script is piped to a Python interpreter for execution followed by an immediate outbound network connection for C2 establishment. This activity is observed when an Empire payload is executed for initial access.

View Source

Detection Logic

sequence by process.parent.entity_id with maxspan=30s
[process where event.type == "start" and event.action == "exec" and 
  process.name == "osascript" and 
  process.args == "-e" and process.command_line like~ "*python*"]
[network where event.type == "start" and event.action == "connection_attempted" and
  process.name like~ "python*" and
   not cidrmatch(destination.ip, 
       "240.0.0.0/4", "233.252.0.0/24", "224.0.0.0/4", "198.19.0.0/16", "192.18.0.0/15", 
       "192.0.0.0/24", "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", 
       "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", 
       "100.64.0.0/10", "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24",
       "::1", "FE80::/10", "FF00::/8")]

Field Validations

Loading…

Comments (0)

Loading comments...