Elastic Defend high stable eql
Suspicious Executable Download via Ruby
Detects when Ruby makes a network connection followed immediately by the rename or modification of a macOS binary. This initial diagnostic rule is meant to allow for an analysis of this activity and tune this rule to detect potential malicious initial access via Ruby scripts or packages.
Detection Logic
sequence by process.entity_id with maxspan=1m
[network where event.type == "start" and process.name == "ruby"]
[file where event.action == "modification" and process.name == "ruby" and
file.Ext.header_bytes like~ ("cffaedfe*", "cafebabe*") and
file.path like~ ("/Users/Shared/*", "/tmp/*", "/private/tmp/*", "/var/tmp/*", "/private/var/tmp/*", "/usr/local/bin/*") and
not file.extension in ("dylib", "so", "bundle")]Field Validations
Loading…
Comments (0)
Loading comments...