Elastic unknown experimental kql

Unusual File Downloads from Source Addresses

This hunt identifies unusual file download activities on Linux systems. It detects instances where commonly used download utilities such as curl and wget are executed with command lines that contain IP addresses, which can indicate potentially suspicious file downloads.

View Source

Detection Logic

from logs-endpoint.events.process-*
| where @timestamp > now() - 7 day
| where host.os.type == "linux" and event.type == "start" and process.name in ("curl", "wget") and process.command_line rlike """.*[0-9]{1,3}(\.[0-9]{1,3}){3}.*"""
| stats cc = count(), host_count = count_distinct(host.id) by process.command_line, process.executable
| where cc <= 10 and host_count <= 5
| sort cc asc
| limit 100

False Positives

  • ⚠ Detects instances where download utilities like curl and wget are used with IP addresses in their command lines.
  • ⚠ Monitors for potentially suspicious file downloads, which are often seen in malicious activities.
  • ⚠ Uses process command line counting in conjunction with host counting to minimize false positives caused by legitimate downloads.
  • ⚠ The process command line count threshold is set to <= 10, and the host count threshold is set to <= 5 to balance detection and noise.

Field Validations

Loading…

Comments (0)

Loading comments...