Elastic high stable eql

Network Connection to OAST Domain via Script Interpreter

Detects when a package service such as npm, gems, or a script interpreter makes an outbound network connection to an OAST (Out-of-band Application Security Testing) domain. Threat actors have been using OAST domains to exfiltrate sensitive data from compromised systems via malicious packages.

View Source

Detection Logic

sequence by process.entity_id with maxspan=1m
  [process where host.os.type == "macos" and event.type == "start" and event.action == "exec" and
    (process.name == "node" or process.name like ("python*", "ruby*", "perl*"))]
  [network where host.os.type == "macos" and event.type == "start" and destination.domain like "*.oast*"]

Field Validations

Loading…

Comments (0)

Loading comments...