Elastic low deprecated eql

Deprecated - Potential Pspy Process Monitoring Detected

This rule leverages auditd to monitor for processes scanning different processes within the /proc directory using the openat syscall. This is a strong indication for the usage of the pspy utility. Attackers may leverage the pspy process monitoring utility to monitor system processes without requiring root permissions, in order to find potential privilege escalation vectors.

View Source

Detection Logic

sequence by process.pid, host.id with maxspan=5s
  [file where host.os.type == "linux" and auditd.data.syscall == "openat" and file.path == "/proc" and
   auditd.data.a0 : ("ffffffffffffff9c", "ffffff9c") and auditd.data.a2 : ("80000", "88000") and
   not process.name in ("agentbeat", "packetbeat")
  ] with runs=10

Field Validations

Loading…

Comments (0)

Loading comments...