← Library
kqlElastic-2.0from elastic/detection-rules

Process Started with Executable Stack

Quality
92
FP risk
—
Forks
0
Views
0
ATT&CK techniques
T1059T1059.004T1620
Rule sourcerules/linux/execution_executable_stack_execution.toml
host.os.type:"linux" and data_stream.dataset:"system.syslog" and process.name:"kernel" and
message:"started with executable stack"