Elastic Defend high stable eql

Potential Data Exfiltration via Curl

Detects the use of curl to upload an archived file to an internet server. Threat actors often will collect data on a system and compress it in an archive file before exfiltrating the file back to their C2 server for review. Many threat actors have been seen utilizing curl to upload this archive file with the collected data to do this. Use of curl in this way while not inherently malicious should be considered highly abnormal and suspicious activity.

View Source

Detection Logic

sequence by process.entity_id with maxspan=15s
[process where event.type == "start" and event.action == "exec" and process.name == "curl" and 
 process.args like~ ("-F", "-T", "-d", "--data*") and 
 process.args like~ ("*@*.zip", "*@*.gz", "*@*.tgz", "b64=@*") and 
 process.args like~ "http*" and
 (process.parent.name like~ ("osascript", "python*", "node", "ruby", "bash", "sh", "zsh", "perl") or (process.parent.code_signature.trusted == false or process.parent.code_signature.exists == false)) and
 not process.args like ("Authorization*", "PRIVATE-TOKEN*") and 
 not process.parent.command_line like "/bin/bash --init-file /Applications/Visual Studio Code.app/Contents/Resources/app/out/vs/workbench/contrib/terminal/common/scripts/shellIntegration-bash.sh" and
 not process.Ext.effective_parent.executable like ("/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
                                               "/Applications/Support.app/Contents/MacOS/Support")]
[network where event.type == "start" and not destination.domain : ("*.cloud.es.io", "*.elastic-cloud.com")]

Field Validations

Loading…

Comments (0)

Loading comments...