Elastic Defend high stable eql

User Discovery Command Execution from Volume Mount

Detects the execution of a user discovery command from a mounted volume. This is highly abnormal behavior and can be an indication of malicious activity.

View Source

Detection Logic

sequence with maxspan=1m
 [process where event.type == "start" and event.action == "exec" and 
   process.executable like "/Volumes/*" and
   not process.executable like "/Volumes/Docker/Docker.app/Contents/MacOS/com.docker.backend" and
   not process.Ext.effective_parent.executable like "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon"] by process.entity_id
 [process where event.type == "start" and event.action == "exec" and 
   process.parent.executable like "/Volumes/*" and process.name in ("whoami", "dscl", "uname")] by process.parent.entity_id

Field Validations

Loading…

Comments (0)

Loading comments...