Elastic critical stable kql

Elastic Defend Alert from Package Manager Install Ancestry

Detects Elastic Defend alerts (behavior, malicious file, memory signature, shellcode) where the alerted process has a package-manager install context in its ancestry: npm (Node.js), PyPI (pip / Python / uv), or Rust (cargo). Install-time spawn chains are a common path for supply-chain and postinstall abuse; this Higher-Order rule surfaces Defend alerts whose process tree includes such activity for prioritization.

View Source

Detection Logic

FROM logs-endpoint.alerts-*, logs-endpoint.events.process-* METADATA _id, _version, _index
| EVAL is_pkg_install = CASE(
    // npm  npx  yarn  pnpm (Node.js ecosystem)
    process.parent.name IN ("node", "node.exe") 
AND (
      process.parent.command_line LIKE "*npm install*" 
OR
      process.parent.command_line LIKE "*npm i *" 
OR
      ends_with(process.parent.command_line, "npm i") 
OR
      process.parent.command_line LIKE "*npx *" 
OR
      process.parent.command_line LIKE "*yarn install*" 
OR
      process.parent.command_line LIKE "*yarn add*" 
OR
      process.parent.command_line LIKE "*pnpm install*" 
OR
      process.parent.command_line LIKE "*pnpm add*" 
OR
      process.parent.command_line LIKE "*npm-cli.js*install*" 
OR
      process.parent.command_line LIKE "*setup.js*"
    ), true,

    // pip  pip3 pipx poetry  uv (Python ecosystem)
    ((process.parent.name like "python*" or process.parent.name like "pip*" or process.parent.name IN ("uv", "uv.exe") ) 
AND (
      process.parent.command_line LIKE "*pip install*" 
OR
      process.parent.command_line LIKE "*pip3 install*" 
OR
      process.parent.command_line LIKE "*-m pip install*" 
OR
      process.parent.command_line LIKE "*setup.py install*" 
OR
      process.parent.command_line LIKE "*setup.py develop*" 
OR
      process.parent.command_line LIKE "*pipx install*" 
OR
      process.parent.command_line LIKE "*poetry install*" 
OR
      process.parent.command_line LIKE "*poetry add*" 
OR
      process.parent.command_line LIKE "*uv pip install*" 
OR
      process.parent.command_line LIKE "*uv add*")), true,

    // cargo (Rust / crates.io ecosystem)
    process.parent.name IN ("cargo", "cargo.exe", "rustc", "rustc.exe") 
AND (
      process.parent.command_line LIKE "*cargo install*" 
OR
      process.parent.command_line LIKE "*cargo build*" 
OR
      process.parent.command_line LIKE "*cargo run*" 
OR
      process.parent.command_line LIKE "*cargo fetch*"), true,

    false
  )
| WHERE process.Ext.ancestry IS NOT NULL 
AND (data_stream.dataset == "endpoint.alerts" 
OR is_pkg_install)

// Capture entity_ids for package install parent processes
| EVAL all_entity_id = CASE(is_pkg_install, process.parent.entity_id, "null")

// Collect all package install entity_ids globally
| INLINE STATS all_pkg_entity_ids = VALUES(all_entity_id) 
WHERE all_entity_id != "null"

// Find which package install entity_ids appear in this process's ancestry
| EVAL Esql.pkg_ancestor_ids = MV_INTERSECTION(all_pkg_entity_ids, process.Ext.ancestry)

// Elastic Defend alerts descended from a package install process
| WHERE Esql.pkg_ancestor_ids IS NOT NULL 
AND data_stream.dataset == "endpoint.alerts"
| KEEP *

Field Validations

Loading…

Comments (0)

Loading comments...