Elastic Defend high stable eql

Suspicious Curl Execution via Automator Workflow

Detects Automator spawning shell interpreters to execute curl with file output arguments within 10 seconds. This indicates abuse of trusted Automator workflows for malicious file downloads.

View Source

Detection Logic

sequence with maxspan=10s
[process where event.type == "start" and event.action == "exec" and process.name in ("bash", "zsh", "sh") and process.args == "-c" and process.parent.name == "Automator"] by process.entity_id
[process where event.type == "start" and event.action == "exec" and process.name in ("curl", "nscurl") and process.args in ("-o", "--output", "-O", "--remote-name")] by process.parent.entity_id

Field Validations

Loading…

Comments (0)

Loading comments...