Elastic Defend high stable eql
Lone Binary Execution from Volume Mount
Detects when a single binary gets executed from a volume mount where no application or package structure exists and the only thing there is the binary. This is highly unusual and suspicious.
Detection Logic
process where event.type == "start" and event.action == "exec" and
process.executable regex~ """/Volumes/[a-zA-Z\s\.0-9]+/[a-zA-Z\s]+"""Field Validations
Loading…
Comments (0)
Loading comments...