Elastic medium stable kql

Suspicious AWS S3 Connection via Script Interpreter

Detects when a script interpreter (osascript, Node.js, Python) with minimal arguments makes an outbound connection to AWS S3 or CloudFront domains. Threat actors have used S3 buckets for both command and control and data exfiltration. Script interpreters connecting to cloud storage should be investigated for potential malicious activity.

View Source

Detection Logic

FROM logs-endpoint.events.network-*
| WHERE host.os.type == "macos" 
    
AND event.type == "start"  
    
AND (process.name == "osascript" 
            
OR process.name == "node" 
            
OR process.name LIKE "python*")  
    
AND (destination.domain LIKE "s3.*.amazonaws.com" 
            
OR destination.domain LIKE "*.s3*.amazonaws.com" 
            
OR destination.domain LIKE "*.cloudfront.net")
| STATS Esql.connection_count = COUNT(*) 
    BY process.entity_id, process.executable, user.name, host.name, destination.domain
| WHERE Esql.connection_count >= 20
| KEEP Esql.*, process.entity_id, process.executable, user.name, host.name, destination.domain

Field Validations

Loading…

Comments (0)

Loading comments...