Karma-X-Inc-protections-artifacts/behavior/rules/execution_possible_java_reverse_shell.toml

[rule]
description = """
Identifies the execution of a shell process from a Java JAR application post an incoming network connection. This
behavior may indicate a reverse shell activity via malicious Java application.
"""
id = "41dcfe9e-9170-4ffe-b620-351736366ced"
license = "Elastic License v2"
name = "Possible JAVA Reverse Shell"
os_list = ["macos"]
version = "1.0.8"

query = '''
sequence with maxspan=5s
[network where event.action in ("connection_accepted", "connection_attempted") and 
 process.name : ("java", "javaw")] by process.entity_id
[process where event.action == "start" and process.parent.name : "java" and
 process.parent.args : "-jar" and
 process.name : ("bash", "sh", "zsh")] by process.parent.entity_id
'''

min_endpoint_version = "8.7.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.7.0"