Elastic Defend high stable eql

Potential HackersChoice Tool Downloaded

Identifies processes that are capable of downloading files with command line arguments containing URLs to HackersChoice's tools. These tools are often used by threat actors to gain access to systems.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and process.name in ("curl", "wget") and 
process.command_line like~ ("*github.com/hackerschoice/*", "*thc.org/*", "*nossl.segfault.net/*", "*gsocket.io/*")

Field Validations

Loading…

Comments (0)

Loading comments...