Elastic medium stable eql

Hping Process Activity

Hping ran on a Linux host. Hping is a FOSS command-line packet analyzer and has the ability to construct network packets for a wide variety of network security testing applications, including scanning and firewall auditing.

View Source

Detection Logic

process where host.os.type == "linux" and event.type == "start" and
 event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
 process.name in ("hping", "hping2", "hping3")

False Positives

  • ⚠ Normal use of hping is uncommon apart from security testing and research. Use by non-security engineers is very uncommon.

Field Validations

Loading…

Comments (0)

Loading comments...