Elastic Defend high stable eql

Unsigned or Untrusted Process Execution and Immediate Self-Deletion

Detects when a process executes and then immediately deletes itself (the file on disk). Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

View Source

Detection Logic

sequence by process.entity_id with maxspan=15s
[process where event.type == "start" and event.action == "exec" and 
  process.executable like ("/Applications/*", "/Volumes/*", "/Users/Shared/*", "/tmp/*", "/private/tmp/*", "/Users/*/Public/*") and
  (process.code_signature.trusted == false or process.code_signature.exists == false)]
[file where event.action == "deletion" and startswith~(file.path,process.executable)]

Field Validations

Loading…

Comments (0)

Loading comments...