kqlElastic-2.0from elastic/detection-rules
Deprecated - EggShell Backdoor Execution
Identifies the execution of and EggShell Backdoor. EggShell is a known post exploitation tool for macOS and Linux.
Quality
92
FP risk
—
Forks
0
Views
0
Rule sourcerules/cross-platform/execution_pentest_eggshell_remote_admin_tool.toml
event.category:process and event.type:(process_started or start) and process.name:espl and process.args:eyJkZWJ1ZyI6*