Elastic Defend high stable eql

Potential VSingle Malware Infection

Identifies the execution traces of the Vsingle malware. Vsingle is a Linux trojan that attempts to retrieve C2 servers information from GitHub.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and process.name in ("wget", "curl") and
process.args like~ ("https://*.php?uid=*&jsid=*", "https://*.php?uid=*&upw=*" ,"*/tmp/.sess_*", "*HTTP/{print $2}*")

Field Validations

Loading…

Comments (0)

Loading comments...