Elastic Defend high stable eql

Python Library Load and Delete

Detects Python loading a library from a user's home directory followed by immediate deletion. This technique is used by malware to execute code while removing forensic evidence.

View Source

Detection Logic

sequence by process.entity_id with maxspan=10s
[library where event.action == "load" and dll.path like~ "/Users/*" and process.name like~ "python*" and
  not dll.name : "*.so"] as event0
[file where event.action == "deletion" and startswith~(file.path, event0.dll.path)]

Field Validations

Loading…

Comments (0)

Loading comments...