Elastic high stable eql

Sensitive Files Compression Inside A Container

Identifies the use of a compression utility to collect known files containing sensitive information, such as credentials and system configurations inside a container.

View Source

Detection Logic

process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
process.entry_leader.entry_meta.type == "container" and process.name in ("zip", "tar", "gzip", "hdiutil", "7z") and
process.command_line like~ (
  "*/root/.ssh/*", "*/home/*/.ssh/*", "*/root/.bash_history*", "*/etc/hosts*", "*/root/.aws/*", "*/home/*/.aws/*",
  "*/root/.docker/*", "*/home/*/.docker/*", "*/etc/group*", "*/etc/passwd*", "*/etc/shadow*", "*/etc/gshadow*"
)

Field Validations

Loading…

Comments (0)

Loading comments...