Elastic medium stable kql

High Number of Process Terminations

This rule identifies a high number (10) of process terminations via pkill from the same host within a short time period.

View Source

Detection Logic

event.category:process and host.os.type:linux and event.type:start and (
  (process.name:"pkill" and process.args:"-f") or
  (process.name:kill and process.args:"-9") or
  (process.name:killall)
)

Field Validations

Loading…

Comments (0)

Loading comments...