admin/elastic-detection-rules
1
0
Fork 0
mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

[Rule Tuning] Curl or Wget Spawned via Node.js (#5904)

Browse Source 
(cherry picked from commit 62b60f9a78)
This commit is contained in:
Ruben Groenewoud
2026-03-31 18:36:59 +02:00
committed by tradebot-elastic
parent de285c8423
commit b59529c2fa
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/cross-platform/command_and_control_curl_wget_spawn_via_nodejs_parent.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/09/18"
integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel", "crowdstrike", "auditd_manager"]
maturity = "production"
updated_date = "2025/12/23"
updated_date = "2026/03/31"
[rule]
author = ["Elastic"]
@@ -116,7 +116,7 @@ process.parent.name in ("node", "bun", "node.exe", "bun.exe") and (
)
) and not (
process.command_line like ("*127.0.0.1*", "*localhost*", "*/home/*/.claude/shell-snapshots/*", "*/root/.claude/shell-snapshots/snapshot*") or
process.parent.executable like ("/*/.cursor-server/*node", "/root/.nvm/*/node", "/*/.vscode-server/*/node", "/home/*/.nvm/*/node", "/home/*/cursor-agent/*/node")
process.parent.executable like ("/*/.cursor-server/*node", "/home/*/cursor-agent/*/node")
)
'''