Elastic Defend high stable eql

Suspicious Powershell Child Process

Detects when Powershell (pwsh) spawns a highly abnormal or suspicious child process. Powershell usage on macOS is extremely rare but usage of Powershell to spawn a process like curl or osascript is almost always indicative of malicious behavior.

View Source

Detection Logic

process where event.type == "start" and 
 (process.parent.name == "pwsh" or process.Ext.effective_parent.name == "pwsh") and 
 process.name like~ ("curl", "nscurl", "osascript") and
 not process.args like~ "http://localhost*" and
 not (
    process.parent.code_signature.team_id == "UBF8T346G9" and process.parent.code_signature.trusted == true and
    process.args == "--aws-sigv4" and process.args like~ "aws:amz:*:monitoring" and process.args == "--config"
)

Field Validations

Loading…

Comments (0)

Loading comments...