Elastic Defend high stable eql

Suspicious Recursive File Deletion via Built-In Utilities

Identifies suspicious use of the Linux rm command to recursively delete user home files and directories. Certain ransomware families abuse this built-in utility to delete user files and important system files after their encryption process is complete.

View Source

Detection Logic

process where event.action == "exec" and

 /* recursive file deletion and multiple directories passed for deletion */
 process.name == "rm" and process.args == "-rf" and process.args_count >= 10 and

 /* encrypting users home or docker folders */
 process.args : ("/home/*", "/var/lib/docker/*") and process.parent.name == "xargs"

Field Validations

Loading…

Comments (0)

Loading comments...