Elastic Defend high stable eql

OsaScript Download Cradle Spawned

Detects when a new OsaScript download cradle is spawned as a backgrounded process to launch a new callback. The Apfell agent payload utilizes this method in order to spawn additional payload callbacks.

View Source

Detection Logic

sequence by process.entity_id with maxspan=15s
[process where event.type == "start" and event.action == "exec" and 
 process.name == "osascript" and process.args == "-l" and 
 process.args like~ "JavaScript" and process.args == "-e" and
 process.parent.name == "osascript"]
[network where event.type == "start" and process.name == "osascript"]

Field Validations

Loading…

Comments (0)

Loading comments...