Elastic Defend high stable eql

Memory File Descriptor Execution from Suspicious Process

This rule detects when a process creates an in-memory file descriptor (memfd_create) followed by an egress network connection from an unusual executable. This sequence of events may indicate malicious activity, such as fileless malware execution and command and control communication.

View Source

Detection Logic

sequence by process.entity_id with maxspan=30s
  [process where event.type == "start" and event.action == "memfd_create" and process.parent.executable != null and (
    process.executable like (
      "memfd:*", "?memfd:*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*", "/run/user/*", "/var/run/user/*",
      "/boot/*", "/sys/*", "/lost+found/*", "/proc/*", "/var/mail/*", "/var/www/*", "/root/*", "/home/*/*"
    ) or
     process.name like ".*"
   ) and
  not (
    process.parent.command_line == "buildah-chroot-runtime" or
    process.command_line == "buildah-chroot-runtime" or
    process.parent.args == "/usr/bin/crun" or
    process.parent.executable like (
      "/usr/bin/nvidia-ctk", "/home/*/.local/share/Steam/*", "./usr/bin/qemu-aarch64", "/dev/.buildkit_qemu_emulator",
      "/snap/docker/*/usr/bin/nvidia-ctk", "/usr/bin/nvidia-cdi-hook", "./usr/local/nvidia/toolkit/nvidia-cdi-hook.real",
      "./usr/bin/qemu-s390x", "/usr/bin/cosmic-files", "/nix/store/*-rofi-unwrapped-*/bin/rofi", "/usr/bin/minecraft-launcher",
      "/usr/local/nvidia/toolkit/nvidia-cdi-hook.real", "/home/*/.steam/*"
    ) or
    process.executable like (
      "./usr/bin/qemu-aarch64", ".", "/home/*/bin/firefox/firefox-bin", "/home/*/bin/firefox/updater",
      "/home/*/.local/share/torbrowser/tbb/x86_64/tor-browser/Browser/updater", "/home/*/.local/opt/tor-browser/app/Browser/updater",
      "/home/*/.local/opt/tor-browser/app/Browser/firefox.real", "/home/*/snap/steam/common/.local/share/Steam/steamapps/common/*/bin/pressure-vessel-wrap",
      "/home/*/.local/share/zen/zen", "/home/*/.local/share/zen/updater", "/home/*/.local/share/umu/steamrt4/pressure-vessel/bin/pressure-vessel-wrap",
      "/home/*/.local/share/Steam/steamapps/common/*/pressure-vessel-wrap", "/home/*/tor-browser-linux-*/tor-browser/Browser/updater",
      "/home/*/.local/share/claude/versions/*", "/home/*/Downloads/*/firefox/*", "/home/*/.local/share/umu/steamrt3/pressure-vessel/bin/steam-runtime-launch-client",
      "/home/*/Desktop/crun/crun-src/crun/crun",
      "/home/*/Zotero_linux-x86_64/*"
    )
  )]
  [process where event.type == "start" and event.action == "exec"]

Field Validations

Loading…

Comments (0)

Loading comments...