Elastic Defend high stable eql

Linux Hidden File Mounted

Detects when a hidden file gets mounted. This is suspicious behavior, and has been observed in MacOS and Linux malware samples.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and (
  process.name in ("mount", "pmount", "lsblk") or 
  (process.name == "udisksctl" and process.args == "mount") 
) and process.args like ("/media/.*", "/mnt/.*", "/tmp/mnt/.*") and 
not process.parent.command_line == "/usr/sbin/automount --pid-file /var/run/autofs.pid"

Field Validations

Loading…

Comments (0)

Loading comments...