Karma-X-Inc-protections-artifacts/behavior/rules/execution_suspicious_interactive_shell_execution.toml

[rule]
description = """
Detects the suspicious use of the -i shell option indicating an interactive session via an abnormal parent process.
Threat actors have been observed using this technique to gain interactive command line access via their payloads in
order to maintain access and conduct post-exploitation actions on the objective.
"""
id = "71c3d317-7c92-4bd7-bbb1-b6ff62f94ebe"
license = "Elastic License v2"
name = "Suspicious Interactive Shell Execution"
os_list = ["macos"]
version = "1.0.6"

query = '''
sequence with maxspan=30s
[network where event.type == "start" and event.action == "connection_attempted" and 
  process.name : (".*", "osascript", "ruby*", "python*")] by process.entity_id
[process where event.type == "start" and event.action == "exec" and 
  process.name : ("bash",  "sh", "zsh") and 
  process.args : ("/bin/bash", "/usr/bin/bash", "/bin/sh", "/usr/bin/sh", "/bin/zsh", "/usr/bin/zsh") and 
  process.args : "-i" and process.args_count == 2 and
  process.parent.name : (".*", "osascript", "ruby*", "python*")] by process.parent.entity_id
'''

min_endpoint_version = "8.3.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.3.0"