Elastic Defend high stable eql

Potential Git CVE-2025-48384 Exploitation

Identifies potential attempts to execute malicious commands via a known git remote code execution vulnerability CVE-2025-48384.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and
 process.parent.name == "git" and process.command_line : "*clone*--recursive*http*" and
 process.name in (
   "dash", "sh", "static-sh", "bash", "bash-static", "zsh", "ash", "csh", "ksh", "tcsh", "busybox", "fish", "ksh93", "rksh", "rksh93", "lksh",
   "mksh", "mksh-static", "csharp", "posh", "rc", "sash", "yash", "zsh5", "zsh5-static"
)

Field Validations

Loading…

Comments (0)

Loading comments...