Elastic Defend high stable eql

Suspicious URL as argument to Self-Signed Binary

Detects the execution of a binary that is untrusted by Apple and self-signed using the Codesign utility where a URL is provided as an argument to the malicious binary in order to download additional tools or establish C2. Threat actors and specifically DPRK threat actors have been see utilizing this technique in order to evade defenses when downloading additional tools or exfiltrating data.

View Source

Detection Logic

process where event.type == "start" and 
 process.code_signature.trusted == false and 
 process.code_signature.signing_id regex~ """[A-Za-z0-9\_\s]{2,}\-[a-z0-9]{40}""" and 
 process.args like~ "http*" and process.args_count <= 3 and 
 not process.args like "http.server" and
 not process.name in ("wget", "curl", "git", "nscurl", "tcptraceroute") and
 not process.executable like ("/opt/homebrew/*", "/usr/local/Cellar/*", "/usr/local/microsoft/powershell/7/pwsh", "*/skills/*/browse/dist/browse")

Field Validations

Loading…

Comments (0)

Loading comments...