Elastic medium stable eql

Suspicious Hidden Child Process of Launchd

Identifies the execution of a launchd child process with a hidden file. An adversary can establish persistence by installing a new logon item, launch agent, or daemon that executes upon login.

View Source

Detection Logic

process where host.os.type == "macos" and event.type in ("start", "process_started") and
 process.name like~ ".*" and process.parent.name == "launchd"

Field Validations

Loading…

Comments (0)

Loading comments...