Elastic Defend high stable eql

Suspicious JavaScript Execution via Deno

Identifies attempts to execute JavaScript using Deno with suspicious command line value. Adversaries may abuse this utility to execute malicious JavaScript.

View Source

Detection Logic

process where event.action== "start" and
 (process.name : "deno.exe" or process.pe.original_file_name == "deno.exe" or process.code_signature.subject_name == "Deno Land Inc.") and
  process.command_line : ("*javascript*base64*", "*eval(*", "*http*", "*javascript*import*")

Field Validations

Loading…

Comments (0)

Loading comments...