Elastic Defend high stable eql

Suspicious OpenSSL Execution via macOS Application

Detects a suspicious sequence of events where a shell (bash, sh, or zsh) is used to launch an application from the /Applications directory, followed by the execution of the 'openssl' command. This pattern could indicate potential malicious activity, such as a shell script attempting to use openssl to perform encryption or decryption operations, exfiltrating sensitive data, or interacting with command and control servers. Monitoring for such sequences can help identify potentially compromised systems or unauthorized activities. This rule alerts on Shlayer malware activity.

View Source

Detection Logic

sequence by process.parent.entity_id with maxspan=30s
[process where event.type == "start" and (process.name in ("bash", "sh", "zsh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and
  process.args like ("*/bin/bash", "*/bin/sh", "*/bin/zsh", "*/bin/dash", "*/bin/csh", "*/bin/tcsh", "*/bin/ksh", "*/bin/tclsh*", "*/bin/fish") and
  process.args like ("/Applications/*", "/Volumes/*") and
  process.args_count <= 2] 
[process where event.type == "start" and process.name == "openssl" and
  not process.parent.executable like "/Library/PrivilegedHelperTools/com.amazonaws.acvc.helper" and
  not process.Ext.effective_parent.executable like ("/usr/local/jamf/*",
                                                    "/Applications/AWS VPN Client/AWS VPN Client.app/Contents/Resources/openvpn/openssl",
                                                    "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon")]

Field Validations

Loading…

Comments (0)

Loading comments...