Elastic Defend high stable eql
Unsigned or Untrusted Application Launch via XPC
Detects when the xpcproxy process starts an application within the /Applications directory, and the parent process is /sbin/launchd. If an application is being launched via xpcproxy with launchd as its parent process, it generally means the application is being started as an XPC service. An application being executed in this specific manner is not normal and based on testing can indicate a malicious application being launched.
Detection Logic
process where event.type == "start" and
process.executable like "/Applications/*" and
process.args like "xpcproxy" and
process.args like~ "application.com.*" and
process.parent.executable like "/sbin/launchd" and
(process.code_signature.trusted == false or process.code_signature.exists == false)Field Validations
Loading…
Comments (0)
Loading comments...