Elastic low stable eql

Shell Execution via Elastic Endpoint

This rule detects shell executions via Elastic Endpoint. Elastic Endpoint has a built-in response action console that can be used to execute shell commands on compromised systems.

View Source

Detection Logic

process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "start") and
process.parent.executable == "/opt/Elastic/Endpoint/elastic-endpoint" and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
process.args in ("-c", "-cl", "-lc", "--command")

Field Validations

Loading…

Comments (0)

Loading comments...