Elastic Defend high stable eql

Malicious Ledger Live Execution

Detects unsigned binaries masquerading as "Ledger Live" cryptocurrency wallet software. These fake applications steal wallet seed phrases and private keys from victims through social engineering.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and process.name like~ "ledger live" and 
 process.code_signature.trusted == false

Field Validations

Loading…

Comments (0)

Loading comments...