Elastic Defend high stable eql

Linux Compilation in Suspicious Directory

Detects the compilation of a binary file in a suspicious directory. Attackers may compile kernel exploits or other software on the target system, to ensure the architecture of the payload matches the target's architecture. Compilation to one of these directories can be an indication of malicious activity.

View Source

Detection Logic

sequence with maxspan=10s
  [process where event.action == "exec" and event.type == "start" and
   process.name like ("*gcc*", "*g++*", "c++", "cc", "c99", "c89", "cc1*", "clang*", "musl-clang", "tcc", "zig", "ccache", "distcc") and
   not process.parent.name in ("go", "cgo")] as event0
  [file where event.action == "creation" and file.path like "/dev/shm/*" and
   process.name like ("ld", "ld.*", "lld", "ld.lld", "mold", "collect2", "*-linux-gnu-ld*", "*-pc-linux-gnu-ld*") and
   stringcontains~(event0.process.command_line, file.name)]

Field Validations

Loading…

Comments (0)

Loading comments...