Elastic Defend high stable eql

Suspicious Automator Workflows Execution

Identifies the execution of the Automator Workflows process followed by a network connection from the XPC service. Adversaries may drop a custom workflow template that hosts malicious JavaScript for Automation (JXA) code as an alternative to using osascript.

View Source

Detection Logic

sequence with maxspan=30s
 [process where event.action == "exec" and process.name == "automator"]
 [network where process.name == "com.apple.automator.runner"]

Field Validations

Loading…

Comments (0)

Loading comments...