Elastic Defend high stable eql

Possible JAVA Reverse Shell

Identifies the execution of a shell process from a Java JAR application post an incoming network connection. This behavior may indicate a reverse shell activity via malicious Java application.

View Source

Detection Logic

sequence with maxspan=5s
[network where event.action in ("connection_accepted", "connection_attempted") and 
 process.name in ("java", "javaw")] by process.entity_id
[process where event.action == "start" and process.parent.name like "java" and
 process.parent.args like~ "-jar" and
 process.name in ("bash", "sh", "zsh")] by process.parent.entity_id

Field Validations

Loading…

Comments (0)

Loading comments...