process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
process.parent.executable != null and
process.command_line : "*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*" and
length(process.command_line) > 50
Install detection rules in Elastic Security
Detect Potential Hex Payload Execution via Command-Line in the Elastic Security detection engine by installing this rule into your Elastic Stack.
To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).