Elastic Defend high stable eql

SSH Keys Accessed by Osascript

Identifies the Osascript process accessing SSH keys. Adversaries may steal SSHkeys in order to gain elevated privileges or move laterally to another system.

View Source

Detection Logic

file where event.action == "open" and 
 file.path like~ "/Users/*/.ssh/*" and process.name == "osascript"

Field Validations

Loading…

Comments (0)

Loading comments...