Elastic low stable eql
Processes with Trailing Spaces
Identify instances where adversaries include trailing space characters to mimic regular files, disguising their activity to evade default file handling mechanisms.
Detection Logic
process where event.type == "start" and event.action in ("exec", "exec_event", "executed", "process_started") and
process.name : "* "Field Validations
Loading…
Comments (0)
Loading comments...