Elastic Defend high stable eql

Powershell Outbound Network Connection

Detects when Powershell (pwsh) on macOS makes an outbound network connection attempt. Powershell usage on macOS is extremely rare but usage of Powershell to connect out to the internet is almost always indicative of malicious behavior.

View Source

Detection Logic

sequence by process.entity_id with maxspan=30s
[process where event.type == "start" and event.action == "exec" and process.name == "pwsh"]
[network where event.type == "start" and event.action == "connection_attempted" and
   not cidrmatch(destination.ip, 
       "240.0.0.0/4", "233.252.0.0/24", "224.0.0.0/4", "198.19.0.0/16", "192.18.0.0/15", 
       "192.0.0.0/24", "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", 
       "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", 
       "100.64.0.0/10", "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24",
       "::1", "FE80::/10", "FF00::/8")]

Field Validations

Loading…

Comments (0)

Loading comments...