Elastic Defend high stable eql

Java Drop followed by network activity

Identifies attempts to execute a JAVA application that was recently dropped followed by network connection. Adversaries may abuse this utility to execute malicious code.

View Source

Detection Logic

sequence by process.entity_id with maxspan=1m
 [process where event.action == "start" and
  (process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500) and
  (process.name : "javaw.exe" or process.pe.original_file_name == "javaw.exe") and process.executable : ("?:\\Users\\*", "?:\\ProgramData\\*", "?:\\Windows\\Temp\\*") and user.id != "S-1-5-18" and
  (
   (process.args_count == 3 and process.args : "-jar") or
   (process.args_count == 4 and process.args : ("-cp", "-classpath") and process.command_line : " *.* ")
  )]
[dns where event.action == "lookup_requested" and dns.question.name like "*.*"]

Field Validations

Loading…

Comments (0)

Loading comments...