Elastic Defend high stable eql

Network File Unzipped via Unsigned or Untrusted Binary

Detects the decompression of a file into a specified folder directly from a network download using unzip via an unsigned or untrusted binary.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and process.name == "unzip" and 
 process.args: "/*/CFNetworkDownload*" and process.args == "-d" and 
 (process.parent.code_signature.trusted == false or process.parent.code_signature.exists == false) and
 not process.parent.name == "figma_agent"

Field Validations

Loading…

Comments (0)

Loading comments...