Elastic Defend high stable eql

Interactive Shell Spawned via Hidden Process

Detects when a hidden process spawns an interactive shell. This behavior may indicate a malicious actor attempting to execute post-exploitation commands.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and process.parent.name like ".*" and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args in ("-i", "-li", "-il") and
not (
  process.parent.executable like ("/nix/store/*", "/tmp/newroot/nix/store/*") or
  process.parent.args == "/usr/bin/crun" or
  process.parent.command_line == "runc init"
)

Field Validations

Loading…

Comments (0)

Loading comments...