Elastic Defend high stable eql

Shell Command Discovery Execution via Untrusted Binary

Detects untrusted binaries spawning shell interpreters to execute discovery commands like whoami, osascript, and dscacheutil within 15 seconds. This pattern indicates malicious reconnaissance activities.

View Source

Detection Logic

sequence with maxspan=15s
[process where event.type == "start" and process.parent.code_signature.trusted == false and (process.name in ("bash", "sh", "zsh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and
 process.args == "-c" and not process.parent.executable like ("/opt/homebrew/*", "/usr/local/Cellar/*")] by process.entity_id
[process where event.type == "start" and event.action == "exec" and (process.parent.name in ("bash", "sh", "zsh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.parent.name like "tclsh*") and
 process.name in ("osascript", "whoami", "dscacheutil", "dsconfigad", "dsexport", "sqlite3") and
 not process.Ext.effective_parent.executable like ("/Applications/*", "/opt/homebrew/*")] by process.parent.entity_id

Field Validations

Loading…

Comments (0)

Loading comments...