Elastic Defend high stable eql

Suspicious Installer Remote Plugin Service Child Process

Detects when the macOS installer application remote plugin service invokes a suspicious process. This activity is highly suspicious and could indicate a malicious installer package attempting to gain initial access via XPC.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and
    (process.parent.executable like "/System/Library/CoreServices/Installer.app/Contents/XPCServices/InstallerRemotePluginService*" or
     process.Ext.effective_parent.executable like "/System/Library/CoreServices/Installer.app/Contents/XPCServices/InstallerRemotePluginService*") and 
    process.name like~ ("tclsh", "python*", "osascript", "curl", "nscurl") and
    not process.args like~ ("open*", "rm*", "touch*")

Field Validations

Loading…

Comments (0)

Loading comments...