[rule]
description = """
Identifies the execution of a shell process from a Java JAR application post an incoming network connection. This
behavior may indicate a reverse shell activity via malicious Java application.
"""
id = "15c94c07-07ec-4e68-a623-e690be3d9d6b"
license = "Elastic License v2"
name = "Potential Reverse Shell via Java"
os_list = ["windows"]
version = "1.0.11"

query = '''
sequence with maxspan=1s
[network where event.action in ("connection_accepted", "connection_attempted") and 
 process.name : ("java.exe", "javaw.exe")] by process.entity_id
[process where event.action == "start" and process.parent.name : "java.exe" and
 process.parent.args : "-jar" and
 process.parent.executable :
                ("?:\\Program Files\\Java\\jre*\\bin\\java.exe",
                 "?:\\Program Files (x86)\\Java\\jre*\\bin\\java.exe",
                 "?:\\Program Files\\AdoptOpenJDK\\jdk-*\\bin\\java.exe",
                 "?:\\Program Files (x86)\\AdoptOpenJDK\\jdk-*\\bin\\java.exe") and
 process.name : ("cmd.exe", "powershell.exe", "conhost.exe")] by process.parent.entity_id
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.7.0"