Elastic Defend high stable eql

Killall Execution via Python

Detects when Python executes the Killall binary in order to kill a process.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and process.parent.name like~ "python*" and process.name == "killall"

Field Validations

Loading…

Comments (0)

Loading comments...