Elastic high deprecated kql

Deprecated - EggShell Backdoor Execution

Identifies the execution of and EggShell Backdoor. EggShell is a known post exploitation tool for macOS and Linux.

View Source

Detection Logic

event.category:process and event.type:(process_started or start) and process.name:espl and process.args:eyJkZWJ1ZyI6*

Field Validations

Loading…

Comments (0)

Loading comments...