Elastic Defend high stable eql

Potential Reverse Shell via Java

Identifies the execution of a shell process from a Java JAR application post an incoming network connection. This behavior may indicate a reverse shell activity via malicious Java application.

View Source

Detection Logic

sequence with maxspan=1s
[network where process.pid != 4 and
 event.action in ("connection_accepted", "connection_attempted") and
 process.name in~ ("java.exe", "javaw.exe")] by process.entity_id
[process where event.action == "start" and process.parent.name : "java.exe" and
 process.parent.args : "-jar" and
 process.parent.executable :
                ("?:\\Program Files\\Java\\jre*\\bin\\java.exe",
                 "?:\\Program Files (x86)\\Java\\jre*\\bin\\java.exe",
                 "?:\\Program Files\\AdoptOpenJDK\\jdk-*\\bin\\java.exe",
                 "?:\\Program Files (x86)\\AdoptOpenJDK\\jdk-*\\bin\\java.exe") and
 process.name in~ ("cmd.exe", "powershell.exe", "conhost.exe")] by process.parent.entity_id

Field Validations

Loading…

Comments (0)

Loading comments...