Elastic Defend high stable eql

Potential Masquerading as System Binary

Detects the execution, by root, of a non-Apple binary passing the path to a System binary as command-line arguments. This activity has only been observed being used by malware in order to masquerade as the system process for the purpose of remaining hidden on the victim machine.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and 
  process.args like "/System/*" and 
  process.parent.name in ("bash", "sh", "zsh") and 
  process.args_count == 1 and not 
  process.executable like ("/System/*", "/usr/libexec/*", "/usr/bin/*", "/usr/sbin/*", "/bin/*", "/sbin/*")

Field Validations

Loading…

Comments (0)

Loading comments...