Elastic Defend high stable eql

Shared Object File Creation and Immediate Preload

Identifies the creation of a new shared object (.so) file followed by a process execution that preloads the newly created shared object using either the LD_PRELOAD or LD_LIBRARY_PATH environment variables. Attackers may leverage this technique to inject malicious code into legitimate processes, thereby enabling stealthy persistence and unauthorized access to the compromised system.

View Source

Detection Logic

sequence with maxspan=5s
  [file where event.action == "creation" and 
   file.path : ("/tmp/*", "/lib/*", "/usr/lib/*", "/var/tmp/*", "/dev/shm/*", "/dev/run/*", "/proc/*") and
   file.extension == "so"] as event0
  [process where event.type == "start" and event.action == "exec" and startswith~(process.env_vars, event0.file.path)]

Field Validations

Loading…

Comments (0)

Loading comments...