Elastic Defend high stable eql

Suspicious Terminal Child Process Execution

Detects the execution of a process in a suspicious location by the Terminal application. Terminal will, often times, be granted full disk access by users and administrators who use it. Threat actors are aware of this and will abuse it in order to get their payloads to execute with the same context as Terminal, providing their payload full disk access. They do this by modifying shell profiles (e.g .zshrc, bashrc, etc.) that point to and execute their payload then when Terminal initiates those profiles the payload gets executed within the same context as Terminal.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and 
 user.name == "root" and 
 process.parent.name like~ "terminal" and
 process.name like~ ("terminal", "zsh", "bash", "sh", "tclsh*") and
 process.args == "-c" and
 process.args like~ 
               ("/private/tmp/*", 
                "/var/tmp/*", 
                "/tmp/*", 
                "/var/folders/*", 
                "/Users/Shared/*", 
                "/Library/Containers/*", 
                "/var/root/*", 
                "/Library/WebServer/*", 
                "/Library/Graphics/*",
                "/Library/Fonts/*", 
                "/usr/local/bin/*", 
                "/Users/*/Library/*", 
                "/Users/*/Applications/*")

Field Validations

Loading…

Comments (0)

Loading comments...