Elastic Defend high stable eql
Suspicious Large Script Execution via Shell Command
Detects when a script interpreter or unsigned/untrusted binary executes an abnormally large shell command. Many different types of macOS malware will hardcode large shell or apple scripts and execute them via a shell command.
Detection Logic
process where event.type == "start" and event.action == "exec" and (process.name in ("bash", "sh", "zsh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and process.args == "-c" and process.command_line == null and process.args_count <= 4 and
(process.parent.name like~ ("osascript", "python*", "node", "sh", "bash", "zsh", "dash", "csh", "tcsh", "ksh", "fish", "tclsh*") or (process.parent.code_signature.trusted == false or process.parent.code_signature.exists == false))Field Validations
Loading…
Comments (0)
Loading comments...