Elastic Defend high stable eql

Potential WizardUpdate Malware Infection

Identifies the execution traces of the WizardUpdate malware. WizardUpdate is a macOS trojan that attempts to infiltrate macOS machines to steal data and it is associated with other types of malicious payloads, increasing the chances of multiple infections on a device.

View Source

Detection Logic

process where event.action == "exec" and
 (
   (process.name in ("sh", "bash", "zsh") and process.command_line : "*=$(curl *eval*$*") or
   (process.name in ("curl", "nscurl") and process.command_line : "*_intermediate_agent_*machine_id*")
 ) and 
 not process.parent.code_signature.team_id in ("UBF8T346G9", "4DE7YGRTPT", "VDXQ22DGB9", "Q6L2SF6YDW", "2DC432GLL2") and 
 process.parent.executable != null

Field Validations

Loading…

Comments (0)

Loading comments...