Elastic high stable kql

Suspicious Named Pipe Creation

This rule detects the creation of unusually labeled named pipes (FIFOs) by the mkfifo command, which is often used by attackers to establish persistence on a target system or to execute commands in the background. Through the new_terms rule type, this rule can identify uncommon process command lines that may indicate the presence of a malicious named pipe.

View Source

Detection Logic

host.os.type:linux and event.category:process and event.type:start and event.action:(exec or ProcessRollup2 or start) and process.name:mkfifo and
process.parent.name:(bash or csh or dash or fish or ksh or sh or tcsh or zsh) and
process.args:((/dev/shm/* or /tmp/* or /var/tmp/*) and not (/*fifo* or /var/tmp/dracut* or /var/tmp/portage/* or /tmp/opencode_install*.trace))

Field Validations

Loading…

Comments (0)

Loading comments...