Elastic Defend high stable eql

Suspicious Electron Command Execution

Detects the use of specific commandline arguments that can be used with certain Electron based applications to covertly execute code for a variety of purposes.

View Source

Detection Logic

sequence with maxspan=15s
[process where event.type == "start" and event.action == "exec"  and 
  process.command_line like~ ("*--gpu-launcher=?*", 
                             "*--utility-cmd-prefix=?*", 
                             "*--browser-subprocess-path=?*", 
                             "*--renderer-cmd-prefix=?*") and
  not process.command_line like~ "*--browser-subprocess-path=/Users/*Chromium Helper*"] by process.entity_id
[process where event.type == "start" and event.action == "exec"] by process.parent.entity_id

Field Validations

Loading…

Comments (0)

Loading comments...