Elastic Defend high stable eql

Suspicious Perl Child Process Execution

Detects when Perl executes suspicious child processes on macOS. Perl can be abused by adversaries to execute malicious commands or scripts.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and process.parent.name == "perl" and 
 (process.name like~ ("python*", "curl", "nscurl", "osascript", "whoami", "cat", "Terminal") or 
  (process.name in ("sh", "zsh", "bash") and process.args_count == 2 and process.args == "-c" and process.args like ("/Users/*", "/tmp/*", "/private/tmp/*"))) and
    not process.parent.command_line like "perl /Library/TeX/texbin/tlmgr*" and 
    not process.Ext.effective_parent.executable like ("/System/*", "/Applications/Xcode.app/Contents/MacOS/Xcode")

Field Validations

Loading…

Comments (0)

Loading comments...