Elastic low stable eql

Trap Signals Execution

Identify activity related where adversaries can include a trap command which then allows programs and shells to specify commands that will be executed upon receiving interrupt signals.

View Source

Detection Logic

process where event.type == "start" and event.action in ("exec", "exec_event", "executed", "process_started") and
process.name == "trap" and process.args : "SIG*"

Field Validations

Loading…

Comments (0)

Loading comments...