Elastic Defend high stable eql

Suspicious Child Process Execution via Interactive Shell

Detects when a process is executed via an interactive shell. C2 platforms will commonly spawn an interactive shell providing the threat actor with a remote shell on the system as if they were physically at the terminal allowing them to send and execute commands manually.

View Source

Detection Logic

sequence by process.Ext.effective_parent.entity_id with maxspan=1m
[process where event.type == "start" and event.action == "exec" and (process.name in ("zsh", "bash", "sh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and
  process.args == "-i" and process.args_count <= 2 and
  process.parent.name like~ ("osascript", "python*", "node")]
[process where event.type == "start" and event.action == "exec" and 
  process.name like~ ("curl", "whoami", "pwd", "nscurl", "wget", "dscl", "osascript", ".*") and
  not process.args like~ ("SendEnv=GIT_PROTOCOL", "-V", "--version", "-ss", "localhost*") and
  not process.parent.executable like~ 
                                  ("/Library/Developer/CommandLineTools/usr/bin/git",
                                   "/Users/*/.pyenv/*",
                                   "/Users/*/.nvm/*",
                                   "/Applications/Docker.app/Contents/Resources/bin/docker-credential-desktop",
                                   "/Applications/Xcode.app/Contents/Developer/usr/bin/git", 
                                   "/opt/homebrew/*") and
  not (process.parent.command_line like "bash /Users/*/.claude/statusline-command.sh" and 
       process.Ext.effective_parent.executable == "/Applications/Visual Studio Code.app/Contents/MacOS/Code")]

Field Validations

Loading…

Comments (0)

Loading comments...