Elastic low stable kql
Process Started with Executable Stack
This rule monitors the syslog log file for messages related to instances of processes that are started with an executable stack. This can be an indicator of a process that is attempting to execute code from the stack, which can be a security risk.
Detection Logic
host.os.type:"linux" and data_stream.dataset:"system.syslog" and process.name:"kernel" and
message:"started with executable stack"Field Validations
Loading…
Comments (0)
Loading comments...