Elastic critical deprecated eql

Malicious Remote File Creation

Malicious remote file creation, which can be an indicator of lateral movement activity.

View Source

Detection Logic

sequence by host.name
[file where event.action == "creation" and process.name : ("System", "scp", "sshd", "smbd", "vsftpd", "sftp-server")]
[file where event.category == "malware" or event.category == "intrusion_detection"
and process.name:("System", "scp", "sshd", "smbd", "vsftpd", "sftp-server")]

Field Validations

Loading…

Comments (0)

Loading comments...