Elastic medium stable eql

Unusual Process Execution Path - Alternate Data Stream

Identifies processes running from an Alternate Data Stream. This is uncommon for legitimate processes and sometimes done by adversaries to hide malware.

View Source

Detection Logic

process where host.os.type == "windows" and event.type == "start" and
  process.args : "?:\\*:*" and
  (
    process.args_count == 1 and

    /* Excludes bug where a missing closing quote sets args_count to 1 despite extra args */
    not process.command_line regex~ """\".*\.exe[^\"].*"""
  )

Field Validations

Loading…

Comments (0)

Loading comments...