Elastic low stable kql

Direct Process Execution via Background Utility

This is a New Terms rule that identifies the first occurrence of setsid or nohup being used to directly execute a process on a host. Attackers may leverage these tools to execute commands in a new session and/or to ignore signals.

View Source

Detection Logic

host.os.type:linux and event.category:process and
event.action:("exec" or "exec_event" or "executed" or "process_started" or "start") and
process.name:("setsid" or "nohup" or "disown") and process.args_count:2

Field Validations

Loading…

Comments (0)

Loading comments...