Elastic medium stable eql

Process Execution Followed by Self-Deletion

Detects a process execution followed by immediate self-deletion, a common technique used by adversaries to remove traces of their activity on the system. This pattern is often observed in malware and APT campaigns.

View Source

Detection Logic

sequence by process.entity_id, host.id with maxspan=30s
  [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and 
  process.executable like (
    "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "/var/www/*",
    "/proc/*/fd/*", "?memfd:*", "memfd:*"
  )] by process.executable
  [file where host.os.type == "linux" and event.action == "deletion"] by file.path

Field Validations

Loading…

Comments (0)

Loading comments...