Elastic high stable eql

Sensitive File Access followed by Compression

Detects when a sensitive file is accessed followed by the immediate creation of a compressed file in a suspicious location. This activity can indicate an attempt to collect sensitive local data and stage it for exfiltration.

View Source

Detection Logic

sequence by process.entity_id with maxspan=30s
  [file where host.os.type == "macos" and event.action == "open" and 
    not file.name in~ ("System.keychain", "login.keychain-db", "preferences.plist", "com.apple.TimeMachine.plist")]
  [file where host.os.type == "macos" and event.action == "modification" and 
    file.extension in ("zip", "gzip", "gz") and
    file.path like~ ("/Users/Shared/*", "/Library/WebServer/*", "/Users/*/Library/WebServer/*",
                     "/Library/Graphics/*", "/Users/*/Library/Graphics/*", "/Library/Fonts/*",
                     "/Users/*/Library/Fonts/*", "/private/var/root/Library/HTTPStorages/*",
                     "/tmp/*", "/var/tmp/*", "/private/tmp/*") and
    not file.path like~ ("/Library/Logs/CrashReporter/*", "/private/tmp/publish.*")]

Field Validations

Loading…

Comments (0)

Loading comments...