Elastic Defend high stable eql

Suspicious DD Execution

Detects suspicious execution of the dd command reading from standard input, often used by infostealer malware to convert decoded data. This technique is uncommon on macOS and typically indicates malicious activity.

View Source

Detection Logic

sequence by process.Ext.effective_parent.entity_id with maxspan=15s
[process where event.type == "start" and event.action == "exec" and (process.name in ("bash", "sh", "zsh", "osascript", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*" or (process.code_signature.trusted == false or process.code_signature.exists == false)) and
  not process.Ext.effective_parent.executable like ("/Library/Addigy/go-agent", 
                                                    "/usr/local/bin/amagent",
                                                    "/Applications/Support.app/Contents/MacOS/Support",
                                                    "/Library/Application Support/Mosyle/MosyleMDM.app/Contents/MacOS/MosyleMDM",
                                                    "/Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentineld_helper.app/Contents/MacOS/sentineld_helper",
                                                    "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
                                                    "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService", 
                                                    "/usr/local/jamf/bin/jamf") and
  not process.parent.command_line like "/bin/bash /Library/Scripts/Elastic SHIELD Firewall Manager LAUNCHD"] 
[process where event.type == "start" and event.action == "exec" and process.name == "dd" and 
  process.command_line : "*if=/dev/stdin*"]

Field Validations

Loading…

Comments (0)

Loading comments...