Elastic Defend high stable eql
Suspicious Curl User Agent
Detects curl commands using the "cur1" user agent string, associated with BlueNoroff/Lazarus Group campaigns. This deliberate misspelling is a reliable indicator of nation-state attacks targeting cryptocurrency sectors.
Detection Logic
process where event.type == "start" and event.action == "exec" and process.name == "curl" and
(process.args like~ "cur1-*" or process.command_line : "*cur1-*")Field Validations
Loading…
Comments (0)
Loading comments...