Elastic high stable eql

Suspicious Execution with NodeJS

Identifies suspicious Node.js execution patterns, including PowerShell-launched module preloads and inline eval, decode, or child-process usage.

View Source

Detection Logic

process where host.os.type == "windows" and event.type == "start" and

(process.name : "node.exe" or ?process.pe.original_file_name == "node.exe" or
 ?process.code_signature.subject_name : ("OpenJS Foundation", "Node.js Foundation")) and

(
  (process.args : ("-r", "--require", "--require=*") and
   process.parent.name : ("powershell.exe", "pwsh.exe")) or

  process.command_line : ("*eval(*", "*atob(*", "*require*child_process*")
)

Field Validations

Loading…

Comments (0)

Loading comments...