Elastic Defend high stable eql
Tclsh Execution followed by immediate Network Connection
Detects the execution of the tclsh binary followed by an immediate network connection by tclsh linked by the process.entity_id value. Tclsh is a shell-like application that reads Tcl commands from its standard input or from a file and evaluates them. Tcl is a high-level programming language. It is still a default installation as of macOS 12 Monterey, making it an ideal candidate for payload execution.
Detection Logic
sequence by process.entity_id with maxspan=15s
[process where event.type == "start" and event.action == "exec" and process.name like~ "tclsh*" and
not process.parent.executable like "/usr/bin/sudo"]
[network where event.type == "start" and process.name like~ "tclsh*"]Field Validations
Loading…
Comments (0)
Loading comments...