Elastic Defend high stable eql

Payload Piped to Script Interpreter

Detects when a script interpreter executes via a shell (sh, bash, zsh) or osascript with only a single argument, being the process name and followed immediately by a network connection. This activity occurs when script code gets piped to the interpreter via a shell and that code is intended to reach out to an external destination like a C2 server.

View Source

Detection Logic

sequence by process.parent.entity_id with maxspan=10s
[process where event.type == "start" and event.action == "exec" and
  process.name like~ ("zsh", "sh", "bash", "python*", "terminal") and
  process.args == "-c" and
  (
    process.command_line : ("*curl*
| *", "*nscurl*
| *", "*wget*
| *", "*osascript*
| *",
                            "*/dev/tcp/*", "*base64*
| *", "*openssl*
| *", "*nc *
| *") or
    process.command_line : ("*curl*>*", "*wget*>*") or
    process.command_line : "*http*
| *"
  )]
[process where event.type == "start" and event.action == "exec" and 
  process.name like~ ("python*", "perl*", "ruby*", "osascript") and
  process.parent.name in ("sh", "bash", "zsh", "osascript") and 
  process.args like~ ("python*", "perl*", "ruby*", "osascript") and 
  process.args_count == 1]

Field Validations

Loading…

Comments (0)

Loading comments...