Elastic Defend high stable eql

Linux Powershell Suspicious Child Process

Detects when Powershell (pwsh) spawns a highly abnormal or suspicious child process. Powershell usage on Linux is rare, and leveraging Powershell to launch any of this list of suspicious utilities may indicate malicious behavior.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and process.parent.name == "pwsh" and
process.name like (
  "nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional", "nc.openbsd", "nc.traditional", "socat", "ngrok", "ping",
  "python*", "php*", "perl*", "ruby*", "lua*", "openssl", "telnet"
) and
not (
  (process.name like "python*" and process.args == "azure.cli") or
  process.parent.executable like~ (
    "/opt/ansible*/Evaluate-STIG/powershell/pwsh", "/evaluate/Evaluate-STIG/powershell/pwsh",
    "/opt/Evaluate-STIG/powershell/pwsh"
  ) or
  process.working_directory like "/opt/azurevstsagent/agent*" or
  process.args like "/home/*/.local/bin/az" or
  (process.parent.args == "./vmware_ap_vcenter.global.ps1" and process.name == "ping")
)

Field Validations

Loading…

Comments (0)

Loading comments...