Elastic high stable eql

Attempt to Unload Elastic Endpoint Security Kernel Extension

Identifies attempts to unload the Elastic Endpoint Security kernel extension via the kextunload command.

View Source

Detection Logic

process where host.os.type == "macos" and event.type in ("start", "process_started") and
 process.name == "kextunload" and process.args like~ ("*.EndpointSecurity", "/System/Library/Extensions/EndpointSecurity.kext", "EndpointSecurity.kext")

Field Validations

Loading…

Comments (0)

Loading comments...