Post by 
April 2, 2025 | 
The Alert
As part of our 24/7 managed SOC service, we aggregate logs from client endpoints into our centralized ELK SIEM platform, giving us full visibility and correlation across the entire infrastructure.
One such log, sent from a SentinelOne Linux agent, was flagged in ELK for immediate attention. The alert pointed to a malware detection event. Our SOC team was reviewing the data.
In the log details, within the incident timeline and event details, we saw:
sentinel_one.threat.name: XORDDoS
Identification
Alert in ELK:
Opening the Incidents view, we could see the threat alert listed as “Malware Threat Detected”. Expanding details for it, we’ll have more information:
Opening the kibana explorer from previous view we can go into timeline for this threat:
And then we should add a column to display the malware name detected by choosing the sentinel_one.threat.name from the Selected fields group on the left:
When we add this column to the view we’ll see the name of the detected malware, and in our case it was XORDDoS:
Response
XORDDoS is a stealthy Linux-targeting Trojan designed to recruit systems into botnets for DDoS attacks. While SentinelOne had already blocked the threat, it was our ELK stack that brought it to the surface and escalated it to human analysts in real time:
- SentinelOne caught the threat
- ELK correlated and escalated the alert
- Our team took action immediately
Isolate the Host
We instantly removed the affected machine from the network to prevent any potential lateral movement or outbound command-and-control communication.
Scan & Clean
A full manual review and additional scans were performed. We confirmed that all malicious components were quarantined and removed — including any persistence mechanisms like cron jobs or disguised binaries.
Sweep the Network
We extended the investigation to the entire network segment. Fortunately, thanks to early detection, there were no signs of further compromise.
With the machine cleaned, the alert resolved, and the surrounding systems cleared, we closed the incident and delivered a post-mortem report to the client. No disruption, no data leakage — just fast detection and even faster response.
