Elastic Defend high stable eql

Suspicious Unload of Elastic Agent via Launchctl

Detects the abnormal unload of the Elastic Agent plist via the launchctl system binary. This activity can indicate an attempt to disable or destroy the agent's ability to continuously monitor system activity and may indicate a threat actors attempt to evade defenses and remain undetected or not be recorded while performing actions on their objective.

View Source

Detection Logic

process where event.type == "start" and 
    (
        (
            process.name == "launchctl" and
            process.args : "unload" and
            process.args like~ "*co.elastic.elastic-agent.plist"
        ) or 
        (
            (process.name in ("sh", "zsh", "bash", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and
            process.args == "-c" and
            process.command_line like~ "*unload*co.elastic.elastic-agent.plist*"
        )
    ) and not 
process.parent.name == "elastic-agent" and not
process.parent.executable like~ ("/sbin/launchd",
                                 "/Library/PrivilegedHelperTools/*",
                                 "/Library/Application Support/Mosyle/MosyleMDM.app/Contents/MacOS/MosyleMDM",
                                 "/usr/local/jamf/bin/jamf", 
                                 "/usr/bin/sudo") and not 
process.Ext.effective_parent.executable like~ ("/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal",
                                               "/usr/local/jamf/bin/jamf",
                                               "/usr/libexec/xpcproxy",
                                               "/Library/Kandji/Kandji Agent.app/Contents/Helpers/Kandji Library Manager.app/Contents/MacOS/kandji-library-manager",
                                               "/Library/PrivilegedHelperTools/com.todyl.SGNCoreHelper", 
                                               "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService",
                                               "/Library/Elastic/Agent/data/elastic-agent*/elastic-agent.app/Contents/MacOS/elastic-agent",
                                               "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
                                               "/opt/jc/bin/jumpcloud-agent",
                                               "/Library/Elastic/Agent/*",
                                               "/Library/PrivilegedHelperTools/com.todyl.SGNCoreHelper",
                                               "/Applications/NinjaRMMAgent/programfiles/ninjarmm-macagent",
                                               "/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon",
                                               "/Library/Endgame/esensor",
                                               "/Library/Application Support/Mosyle/MosyleMDM.app/Contents/MacOS/MosyleMDM",
                                               "/Applications/iTerm.app/Contents/MacOS/iTerm2")

Field Validations

Loading…

Comments (0)

Loading comments...