Elastic medium deprecated kql

Deprecated - Suspicious JAVA Child Process

Identifies suspicious child processes of the Java interpreter process. This may indicate an attempt to execute a malicious JAR file or an exploitation attempt via a JAVA specific vulnerability.

View Source

Detection Logic

event.category:process and event.type:("start" or "process_started") and process.parent.name:"java" and process.name:(
  bash or dash or sh or tcsh or csh or zsh or ksh or fish or python* or php* or perl or ruby or lua* or openssl or
  nc or netcat or ncat or telnet or awk or socat or wget or curl
) and process.args :(
  whoami or id or uname or cat or hostname or ip or curl or wget or pwd or ls or cd or python* or php* or perl or
  ruby or lua* or openssl or nc or netcat or ncat or telnet or awk or socat
)

Field Validations

Loading…

Comments (0)

Loading comments...