Elastic Defend high stable eql

NotificationCenter Silenced via Killall Binary

Detects when the killall process is spawned in order to kill NotificationCenter messages that provide users with pop up system notifications like security warnings etc.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and process.name == "killall" and
 process.args like "NotificationCenter" and
 (process.parent.executable like ("/Applications/*", "/Volumes/*", "/Users/*", "/private/tmp/*", "/tmp/*") or
  process.Ext.effective_parent.executable like ("/Applications/*", "/Volumes/*", "/Users/*", "/private/tmp/*", "/tmp/*")) and
  not (process.parent.code_signature.trusted == true and process.parent.code_signature.team_id in ("8CA6NAN723", "Y75Z7G683Y", "7JVNAY4725")) and
  not process.Ext.effective_parent.executable == "/Applications/Airtame.app/Contents/MacOS/Airtame"

Field Validations

Loading…

Comments (0)

Loading comments...