Elastic Defend: Higher-Order Detection for Multi-Rule Host Compromise
Elastic has released a detection rule that correlates multiple rare Elastic Defend behavior alerts on a single host to identify potential compromise while filtering out common environment-wide noise.
Triage facts
Revision 1- Applicability
- Elastic Defend
- Evidence
- Unknown
- Severity
- Critical
- Action
- Elevated
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 3, 21:42 UTC
- Source quality
- B2Roughly even chance
This detection rule leverages ES|QL INLINE STATS to identify hosts that trigger two or more distinct Elastic Defend behavior alerts within a 60-minute window, where each alert is globally rare (triggered on only one host). The rule is designed to prioritize investigation on hosts exhibiting multiple anomalous behaviors, which often indicate successful compromise or post-exploitation activity. It requires Elastic Stack version 9.4.0 or higher.
Recommendation
- Deploy the 'Multiple Rare Elastic Defend Behavior Rules by Host' rule in environments using Elastic Defend.
- Tune the rule by adding exceptions for known-good administrative scripts or development environments that frequently trigger multiple rare behavioral alerts.
- Investigate flagged hosts by reviewing the specific behavior rule names, parent process command lines, and associated user accounts surfaced by the rule's output fields.
- Prioritize triage for hosts where the flagged activity includes unusual process command lines or indicators of lateral movement.
Threat Hunt
Identify hosts with multiple rare behavioral alerts that did not previously trigger this rule.
Data: Elastic Defend behavior alert telemetry
Mitigations
Configure exceptions for legitimate administrative tools or development hosts to reduce false positives.