Elastic Defend high stable eql

Linux Powershell Encoded Command

Detects the execution of Powershell (pwsh) with the encoded command flag set in the process arguments, in conjunction with an unusual process command line length. Powershell usage on Linux is rare, and the usage of encoded commands with unusual lengths is through Powershell may indicate malicious behavior.

View Source

Detection Logic

process where event.action == "exec" and event.type == "start" and process.name == "pwsh" and
process.args : ("-EncodedCommand", "-enc", "-E") and process.args : ("-nop", "-noprofile") and 
length(process.command_line) >= 100 and not (
  process.parent.name in ("node", "code", "code-insiders", "cursor") or
  process.parent.command_line : "*Invoke-Pester*" or
  process.parent.args == "--utility-sub-type=node.mojom.NodeService" or
  process.parent.executable like ("/data/user/docker/*", "/tmp/.mount_Cursor*/usr/share/cursor/cursor") or
  process.parent.executable in ("/usr/lib/electron30/electron", "/usr/lib/electron32/electron", "/tmp/newroot/proc/self/exe") or
  (
    process.args == "IAAoAEcAZQB0AC0ASABvAHMAdAApAC4AVgBlAHIAcwBpAG8AbgAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAA=" and 
    process.parent.args == "Invoke-LightRail.ps1"
  ) or
  process.args like~ "JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAdABvAHAAJwAKAFsAdgBlAHIAcwBp*" or
  process.args in (
    "VwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAEgARQBMAEwATwAgAFcATwBSAEwARAAnAA==", "dwByAGkAdABlAC0AaABvAHMAdAAgACIAdABlAHMAdAAiAA=",
    "dwByAGkAdABlAC0AaABvAHMAdAAgACIAdABlAHMAdAAiAA=="
  )
)

Field Validations

Loading…

Comments (0)

Loading comments...