admin/elastic-protections-artifacts
1
0
Fork 0
mirror of https://github.com/elastic/protections-artifacts synced 2026-06-08 14:02:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updating artifacts

Browse Source
This commit is contained in:
protectionsmachine
2026-02-25 11:07:41 +00:00
parent 473c853644
commit 3af54b76e1
192 changed files with 1138 additions and 4262 deletions
Download Patch File Download Diff File Expand all files Collapse all files
behavior/rules/cross-platform/command_and_control_suspicious_curl_execution_via_nodejs.toml
+2 -2
View File
@@ -6,12 +6,12 @@ tools via a malicious JavaScript file.
id = "04dc5f8a-8c12-412a-86ca-ef4f2b024531"
license = "Elastic License v2"
name = "Suspicious Curl Execution via NodeJS"
os_list = ["linux", "windows"]
os_list = ["macos", "windows"]
reference = [
"https://www.elastic.co/blog/shai-hulud-worm-npm-supply-chain-compromise",
"https://socket.dev/blog/shai-hulud-strikes-again-v2",
]
version = "1.0.1"
version = "1.0.2"
query = '''
process where event.action in ("start", "exec") and
behavior/rules/cross-platform/defense_evasion_kill_command_executed_from_a_hidden_process.toml
-77
View File
@@ -1,77 +0,0 @@
[rule]
description = """
This rule detects the execution of the `kill` or `pkill` command from a hidden process. Attackers may use hidden
processes to evade detection and establish persistence or execute post-exploitation commands on a target system. Miners
and other types of malware may attempt to kill competing processes to maintain control of the system.
"""
id = "1ab34b34-4cfd-450d-befc-c3503095eaed"
license = "Elastic License v2"
name = "Kill Command Executed from a Hidden Process"
os_list = ["linux", "macos"]
reference = ["https://blog.xlab.qianxin.com/8220-k4spreader-new-tool-en/"]
version = "1.0.6"
query = '''
process where event.type == "start" and event.action == "exec" and process.parent.name : ".*" and
process.name in ("kill", "pkill", "killall") and not process.parent.name in (".", ".azotebg")
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.006"
name = "Indicator Blocking"
reference = "https://attack.mitre.org/techniques/T1562/006/"
[[threat.technique]]
id = "T1564"
name = "Hide Artifacts"
reference = "https://attack.mitre.org/techniques/T1564/"
[[threat.technique.subtechnique]]
id = "T1564.001"
name = "Hidden Files and Directories"
reference = "https://attack.mitre.org/techniques/T1564/001/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/cross-platform/defense_evasion_tampering_of_bash_command_line_history.toml
+28 -14
View File
@@ -7,22 +7,36 @@ id = "31da6564-b3d3-4fc8-9a96-75ad0b364363"
license = "Elastic License v2"
name = "Tampering of Bash Command-Line History"
os_list = ["linux", "macos"]
version = "1.0.23"
version = "1.0.24"
query = '''
process where event.type in ("start", "process_started") and
(
((process.args : ("rm", "echo") or
(process.args : "ln" and process.args : "-sf" and process.args : "/dev/null") or
(process.args : "truncate" and process.args : "-s0"))
and process.args : (".bash_history", "/root/.bash_history", "/home/*/.bash_history","/Users/.bash_history",
"/Users/*/.bash_history",".zsh_history", "/root/.zsh_history", "/home/*/.zsh_history",
"/Users/.zsh_history", "/Users/*/.zsh_history")) or
(process.name : "history" and process.args : "-c") or
(process.args : "export" and process.args : ("HISTFILE=/dev/null", "HISTFILESIZE=0")) or
(process.args : "unset" and process.args : "HISTFILE") or
(process.args : "set" and process.args : "history" and process.args : "+o")
)
process where event.type == "start" and event.action == "exec" and (
(
(
process.name in (
"echo", "rm", "sudo", ".buildkit_qemu_emulator", "vim.basic", "ln", "truncate", "cat",
"coreutils", "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish"
) and (
process.args in ("rm", "echo") or
(process.args == "ln" and process.args == "-sf" and process.args == "/dev/null") or
(process.args == "truncate" and process.args == "-s0")
)
) and
process.args like (
".bash_history", "/root/.bash_history", "/home/*/.bash_history","/Users/.bash_history",
"/Users/*/.bash_history",".zsh_history", "/root/.zsh_history", "/home/*/.zsh_history",
"/Users/.zsh_history", "/Users/*/.zsh_history"
)
) or
(
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "sudo", "logger") and (
(process.args == "export" and process.args : ("HISTFILE=/dev/null", "HISTFILESIZE=0")) or
(process.args == "unset" and process.args : "HISTFILE") or
(process.args == "set" and process.args == "history" and process.args == "+o")
)
) or
(process.name == "history" and process.args == "-c")
)
'''
min_endpoint_version = "7.15.0"
behavior/rules/cross-platform/execution_eggshell_backdoor_execution.toml
-41
View File
@@ -1,41 +0,0 @@
[rule]
description = "Identifies the execution of the EggShell backdoor. EggShell is a known post exploitation tool for macOS and Linux."
id = "feed7842-34a6-4764-b858-6e5ac01a5ab7"
license = "Elastic License v2"
name = "EggShell Backdoor Execution"
os_list = ["linux", "macos"]
reference = ["https://github.com/neoneggplant/EggShell"]
version = "1.0.32"
query = '''
process where event.action == "exec" and
process.executable : ("/private/tmp/*", "/tmp/*") and process.args : "eyJkZWJ1ZyI6*"
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/cross-platform/execution_empire_stager_execution.toml
+9 -4
View File
@@ -8,12 +8,12 @@ license = "Elastic License v2"
name = "Empire Stager Execution"
os_list = ["linux", "macos"]
reference = ["https://github.com/EmpireProject/Empire", "https://github.com/BC-SECURITY/Empire"]
version = "1.0.30"
version = "1.0.31"
query = '''
process where event.action == "exec" and
process.name : ("python*", "osascript", "sh", "bash", "dash", "ksh", "tcsh", "zsh") and
process.command_line : "*exec(base64.b64decode*aW1wb3J0IHN5cztpbXBvcnQg*"
process where event.type == "start" and event.action == "exec" and
process.name like ("python*", "osascript", "sh", "bash", "dash", "ksh", "tcsh", "zsh") and
process.command_line like~ "*exec(base64.b64decode*aW1wb3J0IHN5cztpbXBvcnQg*"
'''
min_endpoint_version = "7.15.0"
@@ -23,6 +23,11 @@ action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
behavior/rules/cross-platform/execution_kill_command_executed_from_binary_in_unusual_location.toml
+7 -5
View File
@@ -1,6 +1,6 @@
[rule]
description = """
This rule detects the execution of the `kill` or `pkill` command from a binary located in an unusual location. Miners
This rule detects the execution of the "kill" or "pkill" command from a binary located in an unusual location. Miners
and other types of malware may attempt to kill competing processes to maintain control of the system.
"""
id = "b9935dcc-e885-4954-9999-3c016b990737"
@@ -8,19 +8,21 @@ license = "Elastic License v2"
name = "Kill Command Executed from Binary in Unusual Location"
os_list = ["linux", "macos"]
reference = ["https://blog.xlab.qianxin.com/8220-k4spreader-new-tool-en/"]
version = "1.0.16"
version = "1.0.17"
query = '''
process where event.type == "start" and event.action == "exec" and process.name in ("kill", "pkill", "killall") and
process.parent.executable like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "./.*") and not (
(process.parent.executable like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "./.*") or process.parent.name like ".*") and
not (
process.parent.executable like (
"/tmp/newroot/*", "/tmp/JobScheduler-Agent-start_rib-*", "/tmp/ubuntu-release-upgrader-*", "/tmp/.criu*",
"/tmp/home-manager-build*/generation/activate", "/tmp/wpsupgrade.prerm", "/tmp/.mount_Cursor*", "/var/tmp/buildah*",
"/tmp/JackettUpdate*/Jackett/JackettUpdater", "/tmp/.*.ansible/ansible-tmp-*", "/tmp/user/*/ubuntu-release-upgrader-*/noble",
"/tmp/snap.rootfs_*/snap/zoom-client/*/zoom/zoom", "/tmp/B1ServerTools.*/opt/sap/SAPBusinessOne/Common/*/bin/java"
"/tmp/snap.rootfs_*/snap/zoom-client/*/zoom/zoom", "/tmp/B1ServerTools.*/opt/sap/SAPBusinessOne/Common/*/bin/java",
"/nix/store/*"
) or
process.executable like "./merged/*" or
process.parent.name like ("check_openvpnauthentication", "python*", "vmis-launcher", "nessuscli", "AppRun") or
process.parent.name like ("check_openvpnauthentication", "python*", "vmis-launcher", "nessuscli", "AppRun", ".", ".azotebg") or
process.command_line in ("pkill -f /nop", "killall -e -9 lmgrd", "killall steam-runtime-launcher-service") or
(process.parent.executable == "/tmp/o.chaban/devpod/agent" and process.command_line == "pkill -HUP dockerd") or
(process.parent.name == "upgrade-execute.sh" and process.command_line == "pkill -SIGHUP -f acconsole")
behavior/rules/cross-platform/execution_privilege_escalation_enumeration_via_linpeas.toml
+2 -2
View File
@@ -1,6 +1,6 @@
[rule]
description = """
Identifies suspicious command line patterns that indicate LinPEAS execution. LinPEAS is a script that search for
Identifies suspicious command line patterns that indicate LinPEAS execution. LinPEAS is a script that searches for
possible paths to escalate privileges on Linux/Unix/MacOS hosts.
"""
id = "92bb2a27-745b-4291-90a1-b7b654df1379"
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "Privilege Escalation Enumeration via LinPEAS"
os_list = ["linux", "macos"]
reference = ["https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS"]
version = "1.0.30"
version = "1.0.31"
query = '''
process where event.action == "exec" and
behavior/rules/cross-platform/impact_darkradiation_ransomware_infection.toml
+4 -4
View File
@@ -11,13 +11,13 @@ os_list = ["linux", "macos"]
reference = [
"https://www.trendmicro.com/en_us/research/21/f/bash-ransomware-darkradiation-targets-red-hat--and-debian-based-linux-distributions.html",
]
version = "1.0.28"
version = "1.0.29"
query = '''
process where event.action == "exec" and
process.name : "xargs" and process.args == "openssl" and process.args == "enc" and
process where event.type == "start" and event.action == "exec" and
process.name == "xargs" and process.args == "openssl" and process.args == "enc" and
/* radiation unicode symbol used by DARKRADIATION ransomware */
process.args : "*.☢*"
process.command_line like "*.☢*"
'''
min_endpoint_version = "7.15.0"
behavior/rules/cross-platform/persistence_persistence_via_genai_tool.toml
+2 -2
View File
@@ -1,6 +1,6 @@
[rule]
description = """
Detects when a GenAI process or descendant attempt to modify commonly abused file persistence entries. This activity
Detects when a GenAI process or descendant attempts to modify commonly abused file persistence entries. This activity
could be the result of exploiting a prompt injection vulnerability or compromised external dependency.
"""
id = "1a2e350a-4f4b-411b-af91-b1555eebe17f"
@@ -11,7 +11,7 @@ reference = [
"https://cymulate.com/blog/cve-2025-547954-54795-claude-inverseprompt/",
"https://specterops.io/blog/2025/11/21/an-evening-with-claude-code/",
]
version = "1.0.1"
version = "1.0.2"
query = '''
sequence by process.entity_id with maxspan=1m
behavior/rules/linux/command_and_control_curl_socks_proxy_activity_from_unusual_parent.toml
-56
View File
@@ -1,56 +0,0 @@
[rule]
description = """
This rule detects the use of the `curl` command-line tool with SOCKS proxy options, launched from an unusual parent
process. Attackers may use `curl` to establish a SOCKS proxy connection to bypass network restrictions and exfiltrate
data or communicate with C2 servers.
"""
id = "0fd5b434-606b-42fc-bed0-87071293533e"
license = "Elastic License v2"
name = "Curl SOCKS Proxy Activity from Unusual Parent"
os_list = ["linux"]
version = "1.0.6"
query = '''
process where event.type == "start" and event.action == "exec" and process.name == "curl" and (
process.parent.executable like (
"/dev/shm/*", "/tmp/*", "/var/tmp/*", "/var/run/*", "/root/*", "/boot/*", "/var/www/html/*", "/opt/.*"
)
) and (
process.args like ("--socks5-hostname", "--proxy", "--preproxy", "socks5*") or
process.args == "-x" or
process.env_vars like ("http_proxy=socks5h://*", "HTTPS_PROXY=socks5h://*", "ALL_PROXY=socks5h://*")
) and not (
process.parent.args == "/etc/newrelic-infra/integrations.d/squid_status.sh" or
process.parent.command_line like (
"*http*localhost*",
"*http*127.0.0.1*",
"/bin/bash --rcfile /home/*/.local/share/JetBrains/Toolbox/apps/goland/plugins/terminal/shell-integrations/bash/bash-integration.bash -i",
"/bin/bash -c /runner/entrypoint.sh"
) or
process.parent.executable in ("/root/bin/create_CVE_html.ksh", "/root/falcon-linux-uninstall.sh") or
process.parent.name == "cf-agent"
)
'''
min_endpoint_version = "8.6.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1572"
name = "Protocol Tunneling"
reference = "https://attack.mitre.org/techniques/T1572/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "8.6.0"
behavior/rules/linux/command_and_control_egress_network_connection_followed_by_command_execution.toml
-93
View File
@@ -1,93 +0,0 @@
[rule]
description = """
Detects network connections originating from a binary located in a potentially suspicious location, followed by command
execution. This behavior is consistent with C2 agents such as Poseidon and Athena, connecting to a C2 framework such as
Mythic. The agent polls the C2 for commands through a web request, after which the command gets executed.
"""
id = "8c2977dd-07ce-4a8e-8ccd-5e4183138675"
license = "Elastic License v2"
name = "Egress Network Connection Followed by Command Execution"
os_list = ["linux"]
version = "1.0.12"
query = '''
sequence with maxspan=5s
[network where event.type == "start" and event.action == "connection_attempted" and process.executable : (
"./*", "/boot/*", "/dev/shm/*", "/etc/cron.*/*", "/etc/init.d/*", "/etc/update-motd.d/*", "/run/*", "/tmp/*",
"/var/tmp/*", "/var/log/*"
) and not (
process.executable : "/tmp/*/*" or
destination.ip == null or
destination.ip == "0.0.0.0" or
cidrmatch(
destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12",
"192.0.0.0/24", "192.0.0.0/29","192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32",
"192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24",
"192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24",
"198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
"FF00::/8"
)
)
] by process.entity_id
[process where event.type == "start" and event.action == "exec" and process.parent.executable : (
"./*", "/boot/*", "/dev/shm/*", "/etc/cron.*/*", "/etc/init.d/*", "/etc/update-motd.d/*", "/tmp/*",
"/var/tmp/*", "/var/log/*"
) and process.args == "-c" and process.args : (
"ip*", "whoami*", "id*", "hostname*", "touch*", "curl*", "wget*", "chmod*", "busybox*", "chattr*", "echo*",
"php*", "perl*", "ruby*", "lua*", "openssl*", "nc*", "netcat*", "ncat*"
) and not (
process.parent.executable in (
"/srv/nessus_agent/sbin/nessus-agent-module", "/var/log/amazon/ssm/patch-baseline-operations", "./app",
"./config.json/usr/local/bin/py.test", "./runc"
) or
process.parent.name in ("nseserv", "nexserv", "pycharm") or
process.parent.command_line == "/usr/bin/php ./boot-watcher.php" or
process.working_directory == "/usr/lib/adlumin"
)
] by process.parent.entity_id
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique.subtechnique]]
id = "T1071.001"
name = "Web Protocols"
reference = "https://attack.mitre.org/techniques/T1071/001/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/command_and_control_hidden_executable_initiated_egress_network_connection.toml
+3 -3
View File
@@ -7,12 +7,12 @@ id = "c14705f7-ebd3-4cf7-88b3-6bff2d832f1b"
license = "Elastic License v2"
name = "Hidden Executable Initiated Egress Network Connection"
os_list = ["linux"]
version = "1.0.3"
version = "1.0.4"
query = '''
sequence by process.entity_id with maxspan=10s
[process where event.type == "start" and event.action == "exec" and process.name : ".*" and
process.args regex~ "[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}"]
[process where event.type == "start" and event.action == "exec" and process.name like ".*" and
process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*"]
[network where event.type == "start" and event.action == "connection_attempted" and not (
destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
behavior/rules/linux/command_and_control_network_connection_by_foomatic_rip_child.toml
-75
View File
@@ -1,75 +0,0 @@
[rule]
description = """
This detection rule addresses multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176,
CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Specifically, this rule detects network connections initiated by a
child processes of foomatic-rip. These flaws impact components like cups-browsed, libcupsfilters, libppd, and
foomatic-rip, allowing remote unauthenticated attackers to manipulate IPP URLs or inject malicious data through crafted
UDP packets or network spoofing. This can result in arbitrary command execution when a print job is initiated.
"""
id = "93d7b72d-3914-44fb-92bf-63675769ef12"
license = "Elastic License v2"
name = "Network Connection by Foomatic-rip Child"
os_list = ["linux"]
reference = [
"https://www.elastic.co/security-labs/cups-overflow",
"https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/",
"https://gist.github.com/stong/c8847ef27910ae344a7b5408d9840ee1",
"https://github.com/RickdeJager/cupshax/blob/main/cupshax.py",
]
version = "1.0.3"
query = '''
sequence with maxspan=10s
[process where event.type == "start" and event.action == "exec" and process.parent.name == "foomatic-rip" and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")] by process.entity_id
[network where event.type == "start" and event.action == "connection_attempted"] by process.parent.entity_id
'''
min_endpoint_version = "8.6.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1203"
name = "Exploitation for Client Execution"
reference = "https://attack.mitre.org/techniques/T1203/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"
[[threat]]
framework = "MITRE ATT&CK"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "8.6.0"
behavior/rules/linux/command_and_control_network_connection_followed_by_file_creation.toml
-94
View File
@@ -1,94 +0,0 @@
[rule]
description = """
Detects network connections originating from a binary located in a potentially suspicious location, followed by a file
creation event. This behavior is consistent with C2 agents such as Poseidon and Athena, connecting to a C2 framework
such as Mythic. The agent polls the C2 for commands through a web request, after which the command gets executed.
"""
id = "08ad673a-7f99-417e-8b93-a79d4faeeed3"
license = "Elastic License v2"
name = "Network Connection Followed by File Creation"
os_list = ["linux"]
version = "1.0.11"
query = '''
sequence by process.entity_id with maxspan=5s
[network where event.type == "start" and event.action == "connection_attempted" and process.executable : (
"/boot/*", "/dev/shm/*", "/etc/cron.*/*", "/etc/init.d/*", "/etc/update-motd.d/*", "/tmp/*", "/var/log/*"
) and not (
process.executable : "/tmp/*/*" or
destination.ip == null or
destination.ip == "0.0.0.0" or
cidrmatch(
destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12",
"192.0.0.0/24", "192.0.0.0/29","192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32",
"192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24",
"192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24",
"198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
"FF00::/8"
)
) and not process.executable : "/merged/var/lib/containers/*"
]
[file where event.type == "creation" and process.executable : (
"/boot/*", "/dev/shm/*", "/etc/cron.*/*", "/etc/init.d/*", "/etc/update-motd.d/*", "/tmp/*", "/var/log/*"
) and not (
file.name : "tmp*" or file.extension in ("sqlite-journal", "db-journal", "lockfile", "tmp") or
file.path : (
"/home/*", "/tmp/*/*", "/loki/wal/*", "/dev/shm/.org.chromium.Chromium.*", "/opt/rapid7/nexpose/*",
"/usr/local/ltechagent*", "/var/lib/cloudendure/agent_keystore_temp", "/var/cache/yum/*",
"/run/aws-node/ipam.json.tmp*", "/run/systemd/journal/streams/.*"
) or
(process.executable == "/tmp/terraform" and file.path like "/tmp/terraform-provider*") or
process.name in ("podman", "minikube", "logrotate", "java", "aws-k8s-agent", "grafana", "postman") or
process.executable : (
"/etc/cron.daily/logrotate", "/etc/update-motd.d/50-motd-news", "/etc/cron.hourly/0yum-hourly.cron",
"/etc/cron.hourly/BitdefenderRedline", "/tmp/token_handler", "/tmp/.sentry-cli*.exe",
"/etc/cron.daily/0yum-daily.cron", "/etc/init.d/fortiedr"
)
)
]
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique.subtechnique]]
id = "T1071.001"
name = "Web Protocols"
reference = "https://attack.mitre.org/techniques/T1071/001/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/command_and_control_potential_multi_architecture_file_downloads.toml
+30 -14
View File
@@ -1,29 +1,35 @@
[rule]
description = """
Identifies the execution of curl, wget or ftpg to download payloads named by architecture type in preparation for
execution. This behavior is consistent with Mirrai bot deployment shell scripts.
execution. This behavior is consistent with Mirai bot deployment shell scripts.
"""
id = "276a5df0-7e20-4218-ade1-3f3ed711d4cb"
license = "Elastic License v2"
name = "Potential Multi Architecture File Downloads"
os_list = ["linux"]
reference = ["https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai"]
version = "1.0.23"
version = "1.0.24"
query = '''
sequence by process.parent.entity_id with maxspan=5s
[process where event.action == "exec" and process.name : ("curl", "wget", "ftpg") and
process.args: ("http*mipsel","http*i686","http*sparc","http*mips","http*sh4","http*x86","http*armv6l",
"http*powerpc","http*i586","http*m68k","http*armv4l","http*armv5l","http*mpsl","http*arm4",
"http*arm5","http*arm6","http*arm7","http*ppc")]
[process where event.action == "exec" and process.name : ("curl", "wget", "ftpg") and
process.args: ("http*mipsel","http*i686","http*sparc","http*mips","http*sh4","http*x86","http*armv6l",
"http*powerpc","http*i586","http*m68k","http*armv4l","http*armv5l","http*mpsl","http*arm4",
"http*arm5","http*arm6","http*arm7","http*ppc")]
[process where event.action == "exec" and process.name : ("curl", "wget", "ftpg") and
process.args: ("http*mipsel","http*i686","http*sparc","http*mips","http*sh4","http*x86","http*armv6l",
"http*powerpc","http*i586","http*m68k","http*armv4l","http*armv5l","http*mpsl","http*arm4",
"http*arm5","http*arm6","http*arm7","http*ppc")]
[process where event.type == "start" and event.action == "exec" and process.name in ("curl", "wget", "ftpg") and
process.args like~ (
"http*mipsel", "http*i686", "http*sparc", "http*mips", "http*sh4","http*x86", "http*armv6l", "http*powerpc",
"http*i586", "http*m68k", "http*armv4l", "http*armv5l", "http*mpsl", "http*arm4", "http*arm5", "http*arm6",
"http*arm7", "http*ppc"
)]
[process where event.type == "start" and event.action == "exec" and process.name in ("curl", "wget", "ftpg") and
process.args like~ (
"http*mipsel", "http*i686", "http*sparc", "http*mips", "http*sh4","http*x86", "http*armv6l", "http*powerpc",
"http*i586", "http*m68k", "http*armv4l", "http*armv5l", "http*mpsl", "http*arm4", "http*arm5", "http*arm6",
"http*arm7", "http*ppc"
)]
[process where event.type == "start" and event.action == "exec" and process.name in ("curl", "wget", "ftpg") and
process.args like~ (
"http*mipsel", "http*i686", "http*sparc", "http*mips", "http*sh4","http*x86", "http*armv6l", "http*powerpc",
"http*i586", "http*m68k", "http*armv4l", "http*armv5l", "http*mpsl", "http*arm4", "http*arm5", "http*arm6",
"http*arm7", "http*ppc"
)]
'''
min_endpoint_version = "7.15.0"
@@ -48,6 +54,16 @@ action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 2
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
behavior/rules/linux/command_and_control_potential_vsingle_malware_infection.toml
+3 -3
View File
@@ -11,11 +11,11 @@ reference = [
"https://blogs.jpcert.or.jp/en/2021/03/Lazarus_malware3.html",
"https://blogs.jpcert.or.jp/en/2022/07/vsingle.html",
]
version = "1.0.24"
version = "1.0.25"
query = '''
process where event.action == "exec" and process.name : ("wget", "curl") and
process.args : ("https://*.php?uid=*&jsid=*", "https://*.php?uid=*&upw=*" ,"*/tmp/.sess_*", "*HTTP/{print $2}*")
process where event.type == "start" and event.action == "exec" and process.name in ("wget", "curl") and
process.args like~ ("https://*.php?uid=*&jsid=*", "https://*.php?uid=*&upw=*" ,"*/tmp/.sess_*", "*HTTP/{print $2}*")
'''
min_endpoint_version = "7.15.0"
behavior/rules/linux/command_and_control_python_network_connection_followed_by_command_execution.toml
+9 -5
View File
@@ -8,11 +8,14 @@ id = "b86c5998-3068-43e8-bfb5-ecb593e34ca9"
license = "Elastic License v2"
name = "Python Network Connection Followed by Command Execution"
os_list = ["linux"]
version = "1.0.11"
version = "1.0.12"
query = '''
sequence with maxspan=5s
[network where event.type == "start" and event.action == "connection_attempted" and process.name like "python*" and not (
sequence with maxspan=3s
[network where event.type == "start" and event.action == "connection_attempted" and
process.name like "python*" and
process.executable like ("/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*") and
not (
destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
"192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
@@ -22,9 +25,10 @@ sequence with maxspan=5s
)
)
] by process.entity_id
[process where event.type == "start" and event.action == "exec" and process.parent.name like "python*" and
[process where event.type == "start" and event.action == "exec" and
process.parent.executable like ("/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*") and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args == "-c" and
process.parent.args_count < 3 and process.args like (
process.parent.args_count < 3 and process.command_line like (
"*whoami*", "* wget *", "* chmod *", "* busybox *", "* chattr *", "* php*", "* perl*", "* ruby*", "* lua*",
"*netcat *", "*ncat *", "*/dev/shm/*", "* base64 *", "*base32*"
) and not (
behavior/rules/linux/credential_access_linux_init_(pid_1)_secret_dump_via_gdb.toml
+2 -2
View File
@@ -9,10 +9,10 @@ license = "Elastic License v2"
name = "Linux init (PID 1) Secret Dump via GDB"
os_list = ["linux"]
reference = ["https://github.com/controlplaneio/truffleproc", "https://github.com/hajzer/bash-memory-dump"]
version = "1.0.5"
version = "1.0.6"
query = '''
process where event.action == "exec" and event.type == "start" and process.name == "gdb" and
process where event.type == "start" and event.action == "exec" and process.name == "gdb" and
process.args in ("--pid", "-p") and process.args == "1"
'''
behavior/rules/linux/credential_access_potential_linux_credential_dumping_via_unshadow.toml
+8 -2
View File
@@ -11,10 +11,11 @@ license = "Elastic License v2"
name = "Potential Linux Credential Dumping via Unshadow"
os_list = ["linux"]
reference = ["https://www.cyberciti.biz/faq/unix-linux-password-cracking-john-the-ripper/"]
version = "1.0.8"
version = "1.0.9"
query = '''
process where event.action == "exec" and process.name == "unshadow" and process.args_count >= 2
process where event.type == "start" and event.action == "exec" and
process.name == "unshadow" and process.args_count >= 2
'''
min_endpoint_version = "8.5.0"
@@ -24,6 +25,11 @@ action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
behavior/rules/linux/credential_access_potential_memory_dumping_via_dd.toml
+2 -2
View File
@@ -8,10 +8,10 @@ license = "Elastic License v2"
name = "Potential Memory Dumping via dd"
os_list = ["linux"]
reference = ["https://github.com/huntergregal/mimipenguin"]
version = "1.0.1"
version = "1.0.2"
query = '''
process where event.type == "start" and event.action == "exec" and process.name == "dd" and process.args : "if=/proc/*/mem*"
process where event.type == "start" and event.action == "exec" and process.name == "dd" and process.args like "if=/proc/*/mem*"
'''
min_endpoint_version = "7.15.0"
behavior/rules/linux/defense_evasion_binary_executed_from_shared_memory_directory.toml
+5 -5
View File
@@ -10,13 +10,13 @@ license = "Elastic License v2"
name = "Binary Executed from Shared Memory Directory"
os_list = ["linux"]
reference = ["https://intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/"]
version = "1.0.10"
version = "1.0.11"
query = '''
process where event.type == "start" and event.action == "exec" and
process.executable : ("/dev/shm/*", "/run/shm/*") and not (
(process.executable : "/dev/shm/gitlab/*" and process.pid == 0) or
(process.executable: "/dev/shm/ansible-tmp*")
process where event.type == "start" and event.action == "exec" and process.executable like ("/dev/shm/*", "/run/shm/*") and
not (
(process.executable like "/dev/shm/gitlab/*" and process.pid == 0) or
(process.executable like "/dev/shm/ansible-tmp*")
)
'''
behavior/rules/linux/defense_evasion_chattr_execution_from_unusual_parent.toml
+6 -5
View File
@@ -1,6 +1,6 @@
[rule]
description = """
This rule detects the execution of the `chattr` command from an unusual parent process. The `chattr` command is used to
This rule detects the execution of the "chattr" command from an unusual parent process. The "chattr" command is used to
change file attributes, and is often used by attackers to hide files or directories or mark them as immutable and/or
undeletable.
"""
@@ -11,12 +11,13 @@ os_list = ["linux"]
reference = [
"https://www.trendmicro.com/en_nl/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html",
]
version = "1.0.8"
version = "1.0.9"
query = '''
process where event.type == "start" and event.action == "exec" and process.name == "chattr" and
(process.parent.executable : ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*") or process.parent.name : ".*") and
process.args : ("-*i*", "+*i*", "+*u*", "-*u*") and not (
process where event.type == "start" and event.action == "exec" and process.name == "chattr" and
process.executable like ("/bin/chattr", "/usr/bin/chattr", "/usr/local/bin/chattr") and
(process.parent.executable like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*") or process.parent.name like ".*") and
process.args like~ ("-*i*", "+*i*", "+*u*", "-*u*") and not (
process.parent.name == "." or
process.parent.executable like (
"./scannerYaraALFA*", "/tmp/newroot/lib/systemd/systemd", "./ldap2sshkeys", "/tmp/newroot/var/lib/docker/rootfs/overlayfs/*/entrypoint.sh",
behavior/rules/linux/defense_evasion_chattr_execution_with_unusual_target_file.toml
+5 -3
View File
@@ -1,6 +1,6 @@
[rule]
description = """
This rule detects the execution of the `chattr` command with an unusual target file. The `chattr` command is used to
This rule detects the execution of the "chattr" command with an unusual target file. The "chattr" command is used to
change file attributes, and is often used by attackers to hide files or directories or mark them as immutable and/or
undeletable.
"""
@@ -11,10 +11,12 @@ os_list = ["linux"]
reference = [
"https://www.trendmicro.com/en_nl/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html",
]
version = "1.0.13"
version = "1.0.14"
query = '''
process where event.type == "start" and event.action == "exec" and process.name == "chattr" and process.args : (
process where event.type == "start" and event.action == "exec" and process.name == "chattr" and
process.executable like ("/bin/chattr", "/usr/bin/chattr", "/usr/local/bin/chattr") and
process.args like (
"/root/.ssh/*", "/home/*/.ssh/*", "/etc/ld.so.preload", "/dev/shm*", "/tmp*", "/var/spool/cron*", "/etc/cron*",
"/etc/init.d/*", "/etc/rc.local", "/etc/passwd", "/etc/shadow", "/etc/group", "/etc/sudoers", "/etc/sudoers.d/*",
"/etc/ssh/*", "/var/tmp*", "/usr/bin/*", "/bin/*", "/usr/local/bin/*", "/sbin/*", "/usr/sbin/*", "/usr/local/sbin/*",
behavior/rules/linux/defense_evasion_cron(d)_service_started_by_unusual_parent.toml
-90
View File
@@ -1,90 +0,0 @@
[rule]
description = """
This rule detects the execution of the systemctl command to start a cron service via an unusual parent process. Malwares
are known to use this technique to evade detection and maintain persistence on the system.
"""
id = "3ee903d9-6839-48d6-9437-3823b77bbeaa"
license = "Elastic License v2"
name = "Cron(d) Service Started by Unusual Parent"
os_list = ["linux"]
version = "1.0.9"
query = '''
process where event.type == "start" and event.action == "exec" and process.name == "systemctl" and
process.args == "start" and process.args in ("cron.service", "crond.service", "cron", "crond") and
process.parent.executable != null and not (
process.parent.name in (
"bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "cron", "sudo", "deb-systemd-invoke", "efs.postinst",
"cron.postinst", "run-document-server.sh", "invoke-rc.d"
) or
process.parent.executable in (
"/opt/deepfence/start_deepfence_agent.sh", "/usr/bin/monit", "/usr/local/bin/gluster-client-toolkit", "/usr/bin/puppet",
"/opt/puppetlabs/puppet/bin/ruby", "/usr/local/sbin/devprom-restore", "/usr/bin/monit"
) or
process.parent.executable like ("/opt/eset/*", "/opt/monit/monit-*/bin/monit") or
process.parent.command_line like ("/usr/bin/python*", "/home/*/.ansible/tmp/ansible-tmp-*") or
process.parent.args == "/usr/bin/deb-systemd-invoke"
)
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"
[[threat.technique.subtechnique]]
id = "T1543.002"
name = "Systemd Service"
reference = "https://attack.mitre.org/techniques/T1543/002/"
[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1564"
name = "Hide Artifacts"
reference = "https://attack.mitre.org/techniques/T1564/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/defense_evasion_defense_evasion_via_bind_mount.toml
+7 -2
View File
@@ -9,12 +9,12 @@ license = "Elastic License v2"
name = "Defense Evasion via Bind Mount"
os_list = ["linux"]
reference = ["https://dfir.ch/posts/slash-proc/"]
version = "1.0.4"
version = "1.0.5"
query = '''
process where event.type == "start" and event.action == "exec" and process.name == "mount" and
process.args in ("-B", "--bind", "-R", "--rbind", "-M", "--move") and
process.args : "/proc/*" and process.args_count >= 5 and not process.args : "/proc/*/*"
process.args like "/proc/*" and process.args_count >= 5 and not process.args like "/proc/*/*"
'''
min_endpoint_version = "7.15.0"
@@ -24,6 +24,11 @@ action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
behavior/rules/linux/defense_evasion_egress_network_connection_from_deleted_executable.toml → behavior/rules/linux/defense_evasion_egress_network_connection_from_deleted_executable_by_root.toml
+4 -3
View File
@@ -5,12 +5,13 @@ may indicate an attempt to evade detection by removing the malicious executable
"""
id = "49ab63a4-ed52-49ac-855b-c298b38b0cb9"
license = "Elastic License v2"
name = "Egress Network Connection from Deleted Executable"
name = "Egress Network Connection from Deleted Executable by Root"
os_list = ["linux"]
version = "1.0.13"
version = "1.0.14"
query = '''
network where event.type == "start" and event.action == "connection_attempted" and process.executable like~ "* (deleted)" and
network where event.type == "start" and event.action == "connection_attempted" and process.executable like "* (deleted)" and
user.id == 0 and
not (
destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
behavior/rules/linux/defense_evasion_execution_of_in_memory_file_via_interactive_session.toml
+2 -3
View File
@@ -13,12 +13,11 @@ reference = [
"https://github.com/MythicAgents/merlin/blob/main/Payload_Type/merlin/container/commands/memfd.go",
"https://x-c3ll.github.io/posts/fileless-memfd_create/",
]
version = "1.0.17"
version = "1.0.18"
query = '''
process where event.type == "start" and event.action == "exec" and process.parent.executable != null and
process.interactive == true and
process.executable regex~ """/proc/[a-z0-9]+/fd/[a-z0-9]+""" and
process.executable like "/proc/*/fd/*" and process.interactive == true and
not (
process.command_line in ("runc init", "/var/gdn/assets/linux/bin/runc init", "/usr/sbin/pfman", "lxc-attach -n rdsd.lv") or
process.args == "datadog-ipc-helper" or
behavior/rules/linux/defense_evasion_global_dynamic_linker_file_copied.toml
-87
View File
@@ -1,87 +0,0 @@
[rule]
description = """
Detects the copying of the Linux dynamic loader binary and subsequent file creation for the purpose of creating a backup
copy. This technique was seen recently being utilized by Linux malware prior to patching the dynamic loader in order to
inject and preload a malicious shared object file. This activity should never occur and if it does then it should be
considered highly suspicious or malicious.
"""
id = "9aff7450-c93c-4b97-8c53-48392d798deb"
license = "Elastic License v2"
name = "Global Dynamic Linker File Copied"
os_list = ["linux"]
reference = ["https://www.linode.com/docs/guides/linux-defense-evasion-hiding-linux-processes/"]
version = "1.0.8"
query = '''
sequence by process.entity_id with maxspan=1m
[process where event.type == "start" and process.name : ("cp", "rsync", "mv") and
process.args : ("/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", "/etc/ld.so.preload")]
[file where event.action == "creation" and file.extension == "so"]
'''
min_endpoint_version = "8.3.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"
[[threat.technique.subtechnique]]
id = "T1574.006"
name = "Dynamic Linker Hijacking"
reference = "https://attack.mitre.org/techniques/T1574/006/"
[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"
[[threat.technique.subtechnique]]
id = "T1574.006"
name = "Dynamic Linker Hijacking"
reference = "https://attack.mitre.org/techniques/T1574/006/"
[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"
[[threat.technique.subtechnique]]
id = "T1574.006"
name = "Dynamic Linker Hijacking"
reference = "https://attack.mitre.org/techniques/T1574/006/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "8.3.0"
behavior/rules/linux/defense_evasion_hexadecimal_ip_command_line_argument.toml
+5 -2
View File
@@ -9,10 +9,13 @@ license = "Elastic License v2"
name = "Hexadecimal IP Command-Line Argument"
os_list = ["linux"]
reference = ["https://asec.ahnlab.com/en/57635/"]
version = "1.0.3"
version = "1.0.4"
query = '''
process where event.type == "start" and event.action == "exec" and process.parent.executable != null and
process where event.type == "start" and event.action == "exec" and process.parent.executable != null and (
process.executable like ("./*", "/boot/*", "/dev/shm/*", "/run/*", "/var/run/*", "/tmp/*", "/var/tmp/*") or
process.name like ("curl", "wget", ".*", "python*", "perl*", "ruby*", "php*", "lua*", "node*")
) and
process.command_line like~ ("*http://0x*", "*https://0x*")
'''
behavior/rules/linux/defense_evasion_in_memory_child_process_execution.toml
+2 -2
View File
@@ -9,12 +9,12 @@ license = "Elastic License v2"
name = "In-Memory Child Process Execution"
os_list = ["linux"]
reference = ["https://man7.org/linux/man-pages/man2/memfd_create.2.html"]
version = "1.0.3"
version = "1.0.4"
query = '''
process where event.type == "start" and event.action == "exec" and process.parent.executable like "?memfd:*" and
not (
process.executable == "/usr/bin/fusermount" or
process.executable in ("/usr/bin/fusermount", "/usr/bin/fusermount3") or
(
process.working_directory == "/run/nordlayer" and
process.parent.command_line in (
behavior/rules/linux/defense_evasion_linux_base64_descendant_egress_network_connection.toml
-96
View File
@@ -1,96 +0,0 @@
[rule]
description = """
This rule detects the execution of a base64 encoded command that spawns a descendant process which in turn establishes
an egress network connection. This may be indicative of an attacker attempting to obfuscate their actions by encoding
commands or data before execution.
"""
id = "30f3021b-032e-4aa0-bc6f-341d0c82fdf5"
license = "Elastic License v2"
name = "Linux Base64 Descendant Egress Network Connection"
os_list = ["linux"]
version = "1.0.4"
query = '''
network where event.type == "start" and event.action == "connection_attempted" and process.executable != null and
descendant of [process where event.type == "start" and event.action == "exec" and process.name == "base64" and
process.args : "*-*d*"] and not (
destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
"192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
"192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
"192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
"FF00::/8"
) or
process.executable like (
"/usr/bin/gitlab-runner-helper", "/var/lib/docker/overlay2/*/node", "/runner/*", "./bin/Runner.Listener", "/usr/bin/osqueryd",
"/opt/*/helm/*/helm", "/usr/lib/git-core/git-remote-https"
)
)
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"
[[threat.technique]]
id = "T1140"
name = "Deobfuscate/Decode Files or Information"
reference = "https://attack.mitre.org/techniques/T1140/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/defense_evasion_linux_compilation_in_suspicious_directory.toml
+16 -12
View File
@@ -8,22 +8,16 @@ id = "52001df2-a3bf-411d-a09c-5f36a9f976b8"
license = "Elastic License v2"
name = "Linux Compilation in Suspicious Directory"
os_list = ["linux"]
version = "1.0.10"
version = "1.0.11"
query = '''
sequence with maxspan=10s
[process where event.action == "exec" and event.type == "start" and
process.name like~ (
"gcc*", "g++*", "c++", "cc", "c99", "c89", "cc1*", "cc1plus*", "clang*", "clang++*",
"musl-gcc", "musl-clang", "*-linux-gnu-gcc*", "*-linux-gnu-g++*", "*-pc-linux-gnu-gcc*",
"tcc", "zig", "ccache", "distcc"
) and
not process.parent.name in ("go", "cgo")
] as event0
[file where event.action == "creation" and process.name like~ (
"ld", "ld.*", "lld", "ld.lld", "mold", "collect2", "*-linux-gnu-ld*", "*-pc-linux-gnu-ld*"
) and file.path : "/dev/shm/*" and stringcontains~(event0.process.command_line, file.name)
]
process.name like ("*gcc*", "*g++*", "c++", "cc", "c99", "c89", "cc1*", "clang*", "musl-clang", "tcc", "zig", "ccache", "distcc") and
not process.parent.name in ("go", "cgo")] as event0
[file where event.action == "creation" and file.path like "/dev/shm/*" and
process.name like ("ld", "ld.*", "lld", "ld.lld", "mold", "collect2", "*-linux-gnu-ld*", "*-pc-linux-gnu-ld*") and
stringcontains~(event0.process.command_line, file.name)]
'''
min_endpoint_version = "8.5.0"
@@ -33,11 +27,21 @@ action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
behavior/rules/linux/defense_evasion_linux_hidden_file_mounted.toml
+4 -5
View File
@@ -7,15 +7,14 @@ id = "5b544dbb-2c66-42cd-a4ee-8d1e5afe9903"
license = "Elastic License v2"
name = "Linux Hidden File Mounted"
os_list = ["linux"]
version = "1.0.5"
version = "1.0.6"
query = '''
process where event.action == "exec" and event.type == "start" and
process.args : ("/media/.*", "/mnt/.*", "/tmp/mnt/.*") and (
process where event.type == "start" and event.action == "exec" and (
process.name in ("mount", "pmount", "lsblk") or
(process.name == "udisksctl" and process.args == "mount")
) and
not process.parent.command_line : "/usr/sbin/automount --pid-file /var/run/autofs.pid"
) and process.args like ("/media/.*", "/mnt/.*", "/tmp/mnt/.*") and
not process.parent.command_line == "/usr/sbin/automount --pid-file /var/run/autofs.pid"
'''
min_endpoint_version = "7.15.0"
behavior/rules/linux/defense_evasion_network_activity_from_in_memory_file.toml
+11 -10
View File
@@ -12,18 +12,19 @@ reference = [
"https://github.com/MythicAgents/merlin/blob/main/Payload_Type/merlin/container/commands/memfd.go",
"https://x-c3ll.github.io/posts/fileless-memfd_create/",
]
version = "1.0.14"
version = "1.0.15"
query = '''
sequence by process.entity_id with maxspan=30s
[process where event.type == "start" and event.action == "exec" and
process.executable regex~ """/proc/[a-z0-9]+/fd/[a-z0-9]+""" and
not process.args : ("/usr/lib/systemd/systemd-executor", "/nix/store/*/systemd-executor*") and
not process.parent.executable : (
"/usr/sbin/runc", "/usr/bin/dockerd", "/lib/systemd/systemd", "/usr/lib/systemd/systemd", "/nix/store/*/systemd",
"/opt/sentinelone/bin/addon-host", "/opt/gitlab/embedded/bin/gitlab-kas"
) and
not process.command_line : "runc init"]
sequence by process.entity_id with maxspan=10s
[process where event.type == "start" and event.action == "exec" and process.executable like "/proc/*/fd/*" and
not (
process.args like ("/usr/lib/systemd/systemd-executor", "/nix/store/*/systemd-executor*") or
process.parent.executable like (
"/usr/sbin/runc", "/usr/bin/dockerd", "/lib/systemd/systemd", "/usr/lib/systemd/systemd", "/nix/store/*/systemd",
"/opt/sentinelone/bin/addon-host", "/opt/gitlab/embedded/bin/gitlab-kas", "/usr/sbin/nordlayerd", "/sbin/init"
) or
process.command_line == "runc init"
)]
[network where event.type == "start" and event.action == "connection_attempted" and not (
cidrmatch(destination.ip, "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
"192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32",
behavior/rules/linux/defense_evasion_potential_masquerading_via__proc_self_exe.toml
+11 -4
View File
@@ -1,17 +1,24 @@
[rule]
description = """
This rule detects when a process is started directly by calling `/proc/self/exe`. This is a technique used by malware to
masquerade the legimate binary name as `exe` in an attempt to evade detection.
This rule detects when a process is started directly by calling "/proc/self/exe". This is a technique used by malware to
masquerade the legitimate binary name as "exe" in an attempt to evade detection.
"""
id = "eb66a097-a2e0-4fc9-b1e8-c59d26fd9f93"
license = "Elastic License v2"
name = "Potential Masquerading via /proc/self/exe"
os_list = ["linux"]
reference = ["https://x.com/CraigHRowland/status/1858296306202292613"]
version = "1.0.3"
version = "1.0.4"
query = '''
process where event.type == "start" and event.action == "exec" and process.command_line == "/proc/self/exe"
process where event.type == "start" and event.action == "exec" and (
process.executable like (
"./*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "/boot/*", "/home/*", "/root/*"
) or
process.name like ".*"
) and
process.command_line == "/proc/self/exe" and
not process.parent.executable in ("/usr/bin/bwrap", "/.init")
'''
min_endpoint_version = "7.15.0"
behavior/rules/linux/defense_evasion_potential_process_injection_via_dd.toml
+2 -4
View File
@@ -11,13 +11,11 @@ os_list = ["linux"]
reference = [
"https://web.archive.org/web/20250129100828/https://cyber.aon.com/aon_cyber_labs/linux-based-inter-process-code-injection-without-ptrace2/",
]
version = "1.0.4"
version = "1.0.5"
query = '''
process where event.type == "start" and event.action == "exec" and process.name == "dd" and
process.args : "if=*" and process.args : "of=/proc/*/mem*"
// add if noisy
// and process.args : "seek=*"
process.args like "if=*" and process.args like "of=/proc/*/mem*"
'''
min_endpoint_version = "7.15.0"
behavior/rules/linux/defense_evasion_potential_proxy_execution_via_sed.toml
+11 -1
View File
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "Potential Proxy Execution via Sed"
os_list = ["linux"]
reference = ["https://gtfobins.github.io/gtfobins/sed/"]
version = "1.0.3"
version = "1.0.4"
query = '''
sequence with maxspan=3s
@@ -26,11 +26,21 @@ action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
behavior/rules/linux/defense_evasion_potential_proxy_execution_via_systemd_run.toml
-95
View File
@@ -1,95 +0,0 @@
[rule]
description = """
This rule detects the execution of a command or binary through the systemd-run binary. Systemd-run can schedule commands
to be executed in the background through systemd. Attackers may use this technique to execute commands while attempting
to evade detection.
"""
id = "1e5af062-4973-42d1-94bb-0c1ecbd8daa4"
license = "Elastic License v2"
name = "Potential Proxy Execution via Systemd-run"
os_list = ["linux"]
version = "1.0.22"
query = '''
process where event.type == "start" and event.action == "exec" and process.name == "systemd-run" and
process.parent.args_count < 3 and process.parent.name != null and not (
process.parent.executable in (
"/usr/lib/systemd", "/lib/systemd/systemd", "/opt/saltstack/salt/run/run", "/etc/update-motd.d/70-available-updates",
"/tmp/newroot/usr/libexec/ptyxis-agent", "/usr/local/sbin/clamscan.sh", "/opt/sentinelone/bin/sentinelone-agent",
"/usr/local/bin/salt-minion", "/var/vanta/launcher", "/opt/traps/bin/pmd", "/usr/sbin/gdm", "/usr/bin/salt-minion",
"/opt/GC_Ext/GC/gc_linux_service", "/usr/lib/plesk-task-manager", "/opt/forticlient/epctrl", "/usr/lib/snapd/snap-exec",
"/usr/bin/yay", "/usr/local/bin/hexnode_agent", "/opt/halcyon/halcyonar/agent", "/usr/local/bin/qsetup", "/usr/bin/pamac",
"/usr/bin/elephant", "/usr/bin/Hyprland"
) or
process.parent.executable like (
"/opt/tableau/tableau_server/packages/scripts.*/after-install", "/opt/acronis/bin/acp-update-controller", "/snap/*",
"/var/lib/amagent/*", "/opt/msp-agent/msp-agent-core", "/opt/beyondtrust/*", "/var/lib/rancher/k3s/*/bin/k3s"
) or
process.parent.name like ("python*", "platform-python*") or
process.parent.name in (
"udevadm", "daemon.start", "snap", "systemd", "ptyxis-agent", "run-slack", "run-firefox", "dbus.service", "k3s-server",
"systemd-udevd", "kubelet", "hyperkube", "kthreadd", "gnome-shell", "xdg-desktop-portal", "firefox", "picus_updater",
"rpm-ostree", "prompt-agent"
) or
process.command_line in (
"/usr/bin/systemd-run /usr/bin/systemctl start man-db-cache-update", "systemd-run env", "systemd-run --user dalla open spain",
"systemd-run --user dnf-automatic-notifyonly.timer", "systemd-run --user systemctl suspend", "systemd-run /var/lib/aws-replication-agent/uninstall-agent.sh",
"systemd-run --on-active=10 --timer-property=AccuracySec=100ms --slice=system.slice systemctl start gc-agent",
"systemd-run --user --scope --unit=tmux-server -- tmux", "systemd-run bash -c sleep 60 && reboot"
) or
process.command_line like~ (
"systemd-run --scope -p CPUQuota=10% rpm -qa*", "systemd-run --scope -p CPUQuota=10% dpkg -l*"
) or
process.parent.command_line in ("runc init", " /usr/local/bin/main") or
process.parent.command_line like ("*/var/lib/waagent/*", "bash ./run.sh") or
process.args in (
"--help", "list-timers", "/usr/lib/udev/kdump-udev-throttler", "kubectl", "--unit=ngt_guest_agent_upgrade", "i3-zoom", "google-chrome",
"thunar", "/usr/bin/google-chrome-stable", "snap.lxd.workaround", "--unit=firefox", "--unit=slack", "--slice=zoom.slice",
"autorandr-launcher", "--unit=restart-dbus", "--unit=autorandr-debounce"
) or
process.args like ("--unit=app-Hyprland-wezterm-*.scope", "--unit=app-Hyprland-swaybg-*.scope", "--unit=rmf_sim_*") or
process.working_directory == "/opt/Tychon/Endpoint/bin" or
(process.args in ("rpm", "dpkg") and process.args like~ "CPUQuota=*") or
(process.args == "--slice=app-graphical.slice" and process.args == "--description=xdg-terminal-exec")
)
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/defense_evasion_potential_proxy_execution_via_tcpdump.toml
+3 -2
View File
@@ -8,10 +8,11 @@ license = "Elastic License v2"
name = "Potential Proxy Execution via Tcpdump"
os_list = ["linux"]
reference = ["https://gtfobins.github.io/gtfobins/tcpdump/"]
version = "1.0.3"
version = "1.0.4"
query = '''
process where event.type == "start" and event.action == "exec" and process.name == "tcpdump" and process.args == "-z"
process where event.type == "start" and event.action == "exec" and process.name == "tcpdump" and process.args == "-z" and
not process.parent.executable == "/usr/lib/systemd/systemd"
// potential tunings
// IOC: /sbin/tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z $TF -Z root
behavior/rules/linux/defense_evasion_linux_file_made_executable_by_suspicious_parent.toml → behavior/rules/linux/defense_evasion_shared_memory_file_turned_executable_by_suspicious_parent.toml
+17 -9
View File
@@ -1,20 +1,23 @@
[rule]
description = """
Detects when a file located in a suspicious location is made executable using chmod via an abnormal or suspicious parent
process. Malware will often drop a second stage payload or file and will need to make it executable before invoking it.
Detects when a file located in the shared memory directory is made executable using chmod via an abnormal or suspicious
parent process. Malware will often drop a second stage payload or file and will need to make it executable before
invoking it.
"""
id = "742037b3-3ef6-4a33-84ed-b26fc6ae322c"
license = "Elastic License v2"
name = "Linux File Made Executable by Suspicious Parent"
name = "Shared Memory File Turned Executable by Suspicious Parent"
os_list = ["linux"]
version = "1.0.9"
version = "1.0.10"
query = '''
process where event.action == "exec" and event.type == "start" and process.name == "chmod" and
process.args like ("+x", "a+x", "0777", "755", "777") and process.args like "/dev/shm/*" and
process.parent.executable != null and not (
(process.parent.executable == "/etc/init.d/nagios" and process.args in (
"/dev/shm/tmp", "/dev/shm/var", "/dev/shm/checkresults")
process where event.type == "start" and event.action == "exec" and process.name == "chmod" and
process.args in ("4755", "755", "777", "0777", "+x", "a+x") and
process.args like "/dev/shm/*" and process.parent.executable != null and
not (
(
process.parent.executable == "/etc/init.d/nagios" and
process.args in ("/dev/shm/tmp", "/dev/shm/var", "/dev/shm/checkresults")
) or
process.parent.executable == "./install-attachment-registration-manager.sh" or
process.parent.command_line == "runc init"
@@ -28,6 +31,11 @@ action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
behavior/rules/linux/defense_evasion_shared_object_load_via_lolbin.toml
-84
View File
@@ -1,84 +0,0 @@
[rule]
description = """
This rule detects when a process not commonly used to load shared objects, is executed with arguments that load a shared
object file. This technique can load a malicious shared object into memory while attempting to evade detection.
"""
id = "42c2e98b-b757-423f-ac25-8183d8c76b97"
license = "Elastic License v2"
name = "Shared Object Load via LoLBin"
os_list = ["linux"]
reference = ["https://gtfobins.github.io/#+library%20load"]
version = "1.0.10"
query = '''
process where event.type == "start" and event.action == "exec" and process.parent.executable != null and (
(process.name == "bash" and process.args == "-c" and process.args like "* enable *-f*.so*") or
(process.name == "openssl" and process.args == "-engine" and process.args like "*.so*") or
(process.name like "python*" and process.args == "-c" and process.args like "*cdll.LoadLibrary*.so*") or
(process.name like "ruby*" and process.args == "-e" and process.args like "*Fiddle.dlopen*.so*") or
(process.name in ("gdb", "gimp", "rview", "rvim", "view", "vim", "vimdiff") and
process.args like "*cdll.LoadLibrary*.so*") or
(process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
process.args == "-c" and process.args like ("*cdll.LoadLibrary*.so*", "*ruby*-e**Fiddle.dlopen*.so*")
)
) and
not (
process.parent.executable like (
"/root/.cache/bazel/_bazel_root/install/*", "/opt/Xilinx/PetaLinux/*", "/usr/bin/find", "/bin/find",
"/opt/nessus_agent/sbin/nessus-agent-module", "/sw/eb/sw/Python/*/bin/python*"
) or
process.parent.name in ("make", "process-wrapper", "bwrap") or
(process.name like "python*" and process.command_line like~ "*import torch*torchinductor*") or
process.command_line like "*https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE*"
)
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/defense_evasion_shell_command_execution_via_kworker.toml
+18 -3
View File
@@ -9,12 +9,22 @@ id = "94943f02-5580-4d1d-a763-09e958bd0f57"
license = "Elastic License v2"
name = "Shell Command Execution via Kworker"
os_list = ["linux"]
version = "1.0.10"
version = "1.0.11"
query = '''
process where event.action == "exec" and event.type == "start" and process.parent.name like "kworker*" and
process where event.type == "start" and event.action == "exec" and process.parent.name like "kworker*" and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args == "-c" and
process.args : "*sh" and process.args_count >= 3 and process.command_line : (
process.args in (
"bash", "/bin/bash", "/usr/bin/bash", "/usr/local/bin/bash",
"sh", "/bin/sh", "/usr/bin/sh", "/usr/local/bin/sh",
"dash", "/bin/dash", "/usr/bin/dash", "/usr/local/bin/dash",
"tcsh", "/bin/tcsh", "/usr/bin/tcsh", "/usr/local/bin/tcsh",
"csh", "/bin/csh", "/usr/bin/csh", "/usr/local/bin/csh",
"zsh", "/bin/zsh", "/usr/bin/zsh", "/usr/local/bin/zsh",
"ksh", "/bin/ksh", "/usr/bin/ksh", "/usr/local/bin/ksh",
"fish", "/bin/fish", "/usr/bin/fish", "/usr/local/bin/fish"
) and
process.args_count >= 3 and process.command_line like (
"*ip*", "*whoami*", "*id*", "*hostname*", "*touch*", "*curl*", "*wget*", "*chmod*", "*busybox*", "*chattr*", "*echo*",
"*python*", "*php*", "*perl*", "*ruby*", "*lua*", "*openssl*", "*nc*", "*netcat*", "*ncat*"
) and not (
@@ -30,6 +40,11 @@ action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
behavior/rules/linux/defense_evasion_shell_execution_of_non_executable_file.toml
+9 -6
View File
@@ -7,16 +7,19 @@ id = "4c61fca2-6f77-474d-a537-2d7fd9ec75e0"
license = "Elastic License v2"
name = "Shell Execution of Non-Executable File"
os_list = ["linux"]
version = "1.0.7"
version = "1.0.8"
query = '''
process where event.action == "exec" and event.type == "start" and process.args_count == 2 and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args : (
process where event.type == "start" and event.action == "exec" and process.args_count == 2 and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
process.args in (
"/bin/bash", "/usr/bin/bash", "/bin/sh", "/usr/bin/sh", "/bin/dash", "/usr/bin/dash", "/bin/zsh", "/usr/bin/zsh",
"/bin/tcsh", "/usr/bin/tcsh", "/bin/csh", "/usr/bin/csh", "/bin/ksh", "/usr/bin/ksh", "/bin/fish", "/usr/bin/fish"
) and process.args : ("*.pid", "*.txt", "*.json", "*.bin", "*.log", "*.dat") and not (
process.args : ("/opt/config/example.txt", "/var/lib/git/beinformed.git/subgit/authors.txt") or
process.parent.args : "/sbin/init" or
) and
process.args like ("*.pid", "*.txt", "*.json", "*.bin", "*.log", "*.dat") and
not (
process.args in ("/opt/config/example.txt", "/var/lib/git/beinformed.git/subgit/authors.txt") or
process.parent.args == "/sbin/init" or
process.parent.executable in ("/usr/bin/emscli", "./runc")
)
'''
behavior/rules/linux/defense_evasion_system_binary_preload_and_immediate_network_connection.toml
-81
View File
@@ -1,81 +0,0 @@
[rule]
description = """
Identifies a standard system binary, such as ls, making a network connection. This activity should be considered highly
abnormal and most likely malicious. This may indicated the process has been preloaded or injected into by malicious
payload. Threat actors will do this in order to hide within safe and usually whitelisted processes.
"""
id = "3002b96e-adaa-4660-b906-e021c0a1c086"
license = "Elastic License v2"
name = "System Binary Preload and immediate Network Connection"
os_list = ["linux"]
version = "1.0.42"
query = '''
sequence by process.entity_id with maxspan=5s
[process where event.type == "start" and event.action == "exec" and
process.executable like~ ("/usr/bin/*", "/bin/*", "/usr/sbin/*", "/sbin/*") and
process.env_vars like~ ("LD_PRELOAD=/home/*",
"LD_PRELOAD=/lib/*",
"LD_PRELOAD=/usr/lib/*",
"LD_PRELAOD=/tmp/*",
"LD_PRELOAD=/dev/shm/*",
"LD_PRELOAD=/run/*") and
process.parent.executable != null and not (
process.env_vars in (
"LD_PRELOAD=/usr/lib/preloadable_libiconv.so",
"LD_PRELOAD=/usr/lib/preloadable_libiconv.so php",
"LD_PRELOAD=/lib/x86_64-linux-gnu/libjemalloc.so.2",
"LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libjemalloc.so.2",
"LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libGLEW.so",
"LD_PRELOAD=/usr/lib/libjemalloc.so.2",
"LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libjemalloc.so.2 ", // space is intended
"LD_PRELOAD=/lib/x86_64-linux-gnu/libSegFault.so",
"LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libjemalloc.so.1 /usr/lib/x86_64-linux-gnu/libjemalloc.so.1"
) or
(process.executable == "/usr/bin/opera" and process.env_vars like~ "LD_PRELOAD=/usr/lib/x86_64-linux-gnu/opera/*")
)
]
[network where event.type == "start" and event.action == "connection_attempted" and
process.executable like~ ("/usr/bin/*", "/usr/sbin/*", "/bin/*", "/sbin/*") and not (
destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
"192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
"192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
"192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
"FF00::/8"
)
)]
'''
min_endpoint_version = "8.6.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1211"
name = "Exploitation for Defense Evasion"
reference = "https://attack.mitre.org/techniques/T1211/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "8.6.0"
behavior/rules/linux/defense_evasion_system_binary_proxy_execution_via_ld.so.toml
+2 -2
View File
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "System Binary Proxy Execution via ld.so"
os_list = ["linux"]
reference = ["https://gtfobins.github.io/gtfobins/ld.so/"]
version = "1.0.6"
version = "1.0.7"
query = '''
process where event.type == "start" and event.action == "exec" and process.parent.executable like (
@@ -17,7 +17,7 @@ process where event.type == "start" and event.action == "exec" and process.paren
process.executable in ("/usr/bin/uptime", "/usr/bin/xkbcomp") or
process.parent.command_line like ("*/home/*/JetBrains/*", "*/snap/intellij-idea-ultimate*") or
process.command_line like "sh -c*/usr/bin/xkbcomp*" or
process.working_directory like "/users/*/.cache/JetBrains/*" or
process.working_directory like ("/users/*/.cache/JetBrains/*", "/var/tmp/mkinitramfs*", "/home/adoagent") or
process.command_line == "/usr/bin/python3.9 -V" or
process.args like "/users/*/.cache/JetBrains/*"
)
behavior/rules/linux/defense_evasion_unusual_process_execution.toml
-82
View File
@@ -1,82 +0,0 @@
[rule]
description = """
This rule detects the execution of processes from unusual locations, such as /boot/, /sys/, /lost+found/, /media/, and
/proc/. This may indicate an attempt to execute a process from a location that is not typical for executable files. This
behavior is often associated with malicious activity, such as process injection or execution of payloads from
non-standard directories.
"""
id = "87bd993d-d2fa-4047-bc7b-d6a4527d6ab8"
license = "Elastic License v2"
name = "Unusual Process Execution"
os_list = ["linux"]
version = "1.0.8"
query = '''
process where event.type == "start" and event.action == "exec" and process.executable like (
"/boot/*", "/sys/*", "/lost+found/*", "/var/mail/*"
) and not (
process.executable like (
"/var/spool/postfix", "/sys/dev/block/*", "/boot/loader/entries", "/sys/devices/*", "/sys/fs/cgroup/*",
"/sys/module/*", "/sys/usr/bin/docker"
) or
process.parent.executable like (
"/proc/self/fd/*", "/proc/*/exe", "/usr/libexec/postfix/master", "/usr/libexec/postfix/pipe", "/usr/share/code/code",
"/usr/sbin/slurmstepd", "/usr/sbin/faxq", "/usr/sbin/faxgetty", "/proc/sys/*", "/sys/devices/system/cpu/online*",
"/proc/*/stat/*", "/sys/kernel/mm/*", "/proc/swaps/*", "/usr/bin/runc", "/bin/runc", "/usr/local/bin/runc",
"/sys/docker-entrypoint.d/*", "/sys/docker-entrypoint.sh"
) or
process.parent.command_line in ("/usr/bin/runc init", "runc init") or
process.working_directory like ("/sys/kernel/*", "/proc/sys/*") or
process.parent.args == "/bin/aws-replication-post-convert.sh"
)
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"
[[threat.technique]]
id = "T1620"
name = "Reflective Code Loading"
reference = "https://attack.mitre.org/techniques/T1620/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/discovery_linux_external_ip_address_discovery_via_curl.toml
-75
View File
@@ -1,75 +0,0 @@
[rule]
description = """
Detects applications making a curl request to a known public IP address lookup web service. Malware tends to perform
this action to assess potential targets.
"""
id = "18439a4c-cd67-43f5-ac42-5c4210edeacb"
license = "Elastic License v2"
name = "Linux External IP Address Discovery via Curl"
os_list = ["linux"]
version = "1.0.15"
query = '''
process where event.type == "start" and event.action == "exec" and process.name == "curl"
and (
process.parent.name : ".*" or process.parent.executable : (
"/tmp/*", "/var/tmp/*", "/dev/shm/*", "/opt/*", "/etc/*", "./*",
"/usr/bin/*", "/bin/*", "/usr/local/bin/*", "/sbin/*", "/usr/sbin/*", "/usr/local/sbin/*",
"/usr/lib/*", "/usr/local/lib/*", "/lib/*", "/lib64/*", "/usr/lib64/*", "/usr/local/lib64/*"
)
) and
process.command_line : (
"*ip-api.com*", "*checkip.dyndns.org*", "*api.ipify.org*", "*whatismyip.akamai.com*", "*bot.whatismyipaddress.com*",
"*ifcfg.me*", "*ifconfig.me*", "*ident.me*", "*ipof.in*", "*ip.tyk.nu*", "*icanhazip.com*", "*curlmyip.com*",
"*wgetip.com*", "*eth0.me*", "*ipecho.net*", "*ip.appspot.com*", "*api.myip.com*", "*geoiptool.com*", "*api.2ip.ua*",
"*api.ip.sb*", "*ipinfo.io*", "*checkip.amazonaws.com*", "*wtfismyip.com*", "*iplogger.*", "*freegeoip.net*",
"*freegeoip.app*", "*ipinfo.io*", "*geoplugin.net*", "*myip.dnsomatic.com*", "*www.geoplugin.net*",
"*api64.ipify.org*", "*ip4.seeip.org*", "*.geojs.io*", "*portmap.io*", "*api.2ip.ua*", "*api.db-ip.com*",
"*geolocation-db.com*", "*httpbin.org*", "*myip.opendns.com*", "*ipv4.icanhazip.com*", "*ipv6.icanhazip.com*"
) and
not (
process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "jamf", "make") or
process.parent.name in (".", "./alert_api_call.sh", "nvim", "teleport") or
process.parent.executable like (
"/usr/local/bin/teleport", "/usr/local/bin/current_ip", "/tmp/go-build*", "/usr/bin/neofetch",
"/usr/bin/show-location-info", "/opt/tpot/bin/myip.sh", "/usr/sbin/sshd", "/tmp/newroot/var/quest/kace/scripts/*",
"./Linux_Inventory_Sheets.sh", "/opt/qvm/bin/update_info_qsuite", "/usr/lib/check_mk_agent/local/public_ip_check",
"/opt/teleport/system/bin/teleport", "/opt/Elastic/Endpoint/elastic-endpoint", "/etc/update-motd.d/motd.sh",
"/opt/coe/cadence/IC231/tools.lnx86/cda/bin/64bit/cda.exe", "/etc/update-motd.d/10-armbian-header",
"/opt/saltstack/salt/bin/python*", "/usr/bin/python*", "/usr/local/bin/detect-external-ip"
) or
process.parent.args in ("/var/www/html/admin/modules/leucoalarm/scripts/system.php", "/etc/cont-init.d/50-ddns") or
(
process.parent.executable == "/usr/bin/java" and
process.args : "/opt/streamsets-datacollector/libexec/bootstrap-libs/*"
) or
process.parent.command_line == "runc init" or
(
process.parent.executable == "/usr/bin/busybox" and
(process.parent.command_line == "sh /etc/cont-init.d/50-ddns" or process.working_directory == "/opt/outline-server")
)
)
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1016"
name = "System Network Configuration Discovery"
reference = "https://attack.mitre.org/techniques/T1016/"
[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/execution_background_task_execution_via_a_hidden_process.toml
+7 -4
View File
@@ -7,15 +7,18 @@ id = "2dc02903-9487-4152-87ac-f1c6c7f3a7d3"
license = "Elastic License v2"
name = "Background Task Execution via a Hidden Process"
os_list = ["linux"]
version = "1.0.5"
version = "1.0.6"
query = '''
process where event.type == "start" and event.action == "exec" and
(process.parent.name like~ ".*" or process.name like~ ".*") and
(process.parent.args like~ "*&" or process.args like~ "*&") and
(process.parent.name like ".*" or process.name like ".*") and
(process.parent.args like "*&" or process.args like "*&") and
not (
process.parent.command_line == "runc init" or
process.parent.executable in (".", "/usr/bin/podman")
process.parent.executable like (
".", "/usr/bin/podman", "./.runc-wrapped", "/nix/store/*", "/dev/.buildkit_qemu_emulator"
) or
process.parent.args in ("/usr/bin/crun", "lxc-attach")
)
'''
behavior/rules/linux/execution_bind_shell_via_node.toml
+3 -2
View File
@@ -8,11 +8,12 @@ license = "Elastic License v2"
name = "Bind Shell via Node"
os_list = ["linux"]
reference = ["https://gtfobins.github.io/gtfobins/node/"]
version = "1.0.3"
version = "1.0.4"
query = '''
process where event.type == "start" and event.action == "exec" and process.name == "node" and
process.args == "-e" and process.args : "*spawn*sh*" and process.args : "*listen*"
process.args == "-e" and process.command_line : "*spawn*sh*" and process.command_line : "*listen*" and
not process.parent.executable like "/home/*/.local/zed.app/libexec/zed-editor"
'''
min_endpoint_version = "7.15.0"
behavior/rules/linux/execution_command_interpreter_with_ip_address_argument.toml
+11 -11
View File
@@ -7,22 +7,22 @@ id = "99c1bc0d-6d96-4e3c-b246-c23a65971455"
license = "Elastic License v2"
name = "Command Interpreter with IP Address Argument"
os_list = ["linux"]
version = "1.0.7"
version = "1.0.8"
query = '''
sequence by process.entity_id with maxspan=5s
[process where event.type == "start" and event.action == "exec" and
process.parent.name like~ ("python*", "perl*", "ruby*", "php*", "lua*", "node") and
[process where event.type == "start" and event.action == "exec" and process.parent.executable like (
"/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*",
"/bin/perl*", "/usr/bin/perl*", "/usr/local/bin/perl*",
"/bin/ruby*", "/usr/bin/ruby*", "/usr/local/bin/ruby*",
"/bin/php*", "/usr/bin/php*", "/usr/local/bin/php*",
"/bin/lua*", "/usr/bin/lua*", "/usr/local/bin/lua*",
"/bin/node", "/usr/bin/node", "/usr/local/bin/node"
) and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args == "-c" and
process.command_line like~ ("*curl*http*", "*wget*http*") and
process.command_line regex~ ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*" and not (
process.command_line like~ ("*localhost*", "*127.0.0.1*") or
process.parent.executable like (
"/mnt/Xilinx/PetaLinux/*", "/usr/local/cpanel/3rdparty/bin/php", "/var/anaconda3/envs/*/python",
"/usr/share/cagefs-skeleton/usr/local/cpanel/3rdparty/bin/php"
) or
(process.parent.executable like "/usr/local/cpanel/3rdparty/php/*/bin/php" and process.command_line like "*downloads.wordpress.org/*.*.*.*.zip*")
)]
process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*" and
not process.command_line like~ ("*localhost*", "*127.0.0.1*")]
[network where event.type == "start" and event.action == "connection_attempted" and process.name in ("curl", "wget") and
not (destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
behavior/rules/linux/execution_file_creation_by_foomatic_rip_child.toml
-58
View File
@@ -1,58 +0,0 @@
[rule]
description = """
This detection rule addresses multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176,
CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Specifically, this rule detects suspicious file creation events
executed by child processes of foomatic-rip. These flaws impact components like cups-browsed, libcupsfilters, libppd,
and foomatic-rip, allowing remote unauthenticated attackers to manipulate IPP URLs or inject malicious data through
crafted UDP packets or network spoofing. This can result in arbitrary command execution when a print job is initiated.
"""
id = "112ed0c3-9685-4786-ad79-8307a2d426bf"
license = "Elastic License v2"
name = "File Creation by Foomatic-rip Child"
os_list = ["linux"]
reference = [
"https://www.elastic.co/security-labs/cups-overflow",
"https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/",
"https://gist.github.com/stong/c8847ef27910ae344a7b5408d9840ee1",
"https://github.com/RickdeJager/cupshax/blob/main/cupshax.py",
]
version = "1.0.4"
query = '''
sequence with maxspan=10s
[process where event.type == "start" and event.action == "exec" and process.parent.name == "foomatic-rip" and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")] by process.entity_id
[file where event.type != "deletion" and
not (process.name == "gs" and file.path like (
"/tmp/gs_*", "/var/spool/cups/tmp/gs_*", "/tmp/newroot/tmp/gs_*"
)
)] by process.parent.entity_id
'''
min_endpoint_version = "8.6.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1203"
name = "Exploitation for Client Execution"
reference = "https://attack.mitre.org/techniques/T1203/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[internal]
min_endpoint_version = "8.6.0"
behavior/rules/linux/execution_foomatic_rip_shell_execution.toml
-58
View File
@@ -1,58 +0,0 @@
[rule]
description = """
This detection rule addresses multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176,
CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Specifically, this rule detects shell executions from the
foomatic-rip parent process. These flaws impact components like cups-browsed, libcupsfilters, libppd, and foomatic-rip,
allowing remote unauthenticated attackers to manipulate IPP URLs or inject malicious data through crafted UDP packets or
network spoofing. This can result in arbitrary command execution when a print job is initiated.
"""
id = "8ccebdc1-9929-4584-ac8f-a96ee8e8c616"
license = "Elastic License v2"
name = "Foomatic-rip Shell Execution"
os_list = ["linux"]
reference = [
"https://www.elastic.co/security-labs/cups-overflow",
"https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/",
"https://gist.github.com/stong/c8847ef27910ae344a7b5408d9840ee1",
"https://github.com/RickdeJager/cupshax/blob/main/cupshax.py",
]
version = "1.0.5"
query = '''
process where event.type == "start" and event.action == "exec" and process.parent.name == "foomatic-rip" and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and not (
process.command_line like (
"*/tmp/foomatic-*", "*-sDEVICE=ps2write*", "*printf*", "/bin/sh -e -c cat", "/bin/bash -c cat",
"/bin/bash -e -c cat", "/bin/sh -e -c pdftops*"
) or
process.args like "gs*"
)
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1203"
name = "Exploitation for Client Execution"
reference = "https://attack.mitre.org/techniques/T1203/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/execution_interactive_shell_spawned_via_hidden_process.toml
-65
View File
@@ -1,65 +0,0 @@
[rule]
description = """
Detects when a hidden process spawns an interactive shell. This behavior may indicate a malicious actor attempting to
execute post-exploitation commands.
"""
id = "52deef30-e633-49e1-9dd2-da1ad6cb5e43"
license = "Elastic License v2"
name = "Interactive Shell Spawned via Hidden Process"
os_list = ["linux"]
version = "1.0.5"
query = '''
process where event.type == "start" and event.action == "exec" and process.parent.name : ".*" and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args == "-i" and
not (
process.parent.executable like ("/nix/store/*/rider/bin/.rider-wrapped", "/tmp/newroot/nix/store/*/rider/bin/.rider-wrapped") or
process.parent.args == "/usr/bin/crun" or
process.parent.command_line == "runc init"
)
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1564"
name = "Hide Artifacts"
reference = "https://attack.mitre.org/techniques/T1564/"
[[threat.technique.subtechnique]]
id = "T1564.001"
name = "Hidden Files and Directories"
reference = "https://attack.mitre.org/techniques/T1564/001/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/execution_interpreter_based_code_execution_via_unusual_parent.toml
-103
View File
@@ -1,103 +0,0 @@
[rule]
description = "This rule detects suspicious command-line arguments that are commonly used by attackers to execute malicious code."
id = "5f6f48d9-592c-46d3-863b-9c06fa248e2d"
license = "Elastic License v2"
name = "Interpreter-Based Code Execution via Unusual Parent"
os_list = ["linux"]
version = "1.0.7"
query = '''
process where event.type == "start" and event.action == "exec" and process.parent.executable like (
"/tmp/*", "/dev/shm/*", "/var/tmp/*", "/boot/*", "/sys/*", "/lost+found/*", "/media/*", "/proc/*",
"/var/backups/*", "/var/log/*", "/var/mail/*", "/var/spool/*"
) and (
(process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args == "-c") or
(process.executable like (
"/tmp/*", "/dev/shm/*", "/var/tmp/*", "/boot/*", "/sys/*", "/lost+found/*", "/media/*", "/proc/*",
"/var/backups/*", "/var/log/*", "/var/mail/*", "/var/spool/*"
)
)
) and
process.command_line like~ ("*python* -c*", "*perl* -e*", "*php* -r*", "*ruby* -e*", "*lua* -e*", "*node* -e*") and
process.command_line like~ (
// Python
"*exec(*base64*", "*exec(*decode(*", "*exec(*marshal*", "*exec(*pickle*", "*eval(*exec(*",
"*eval(*", "*subprocess.run(*", "*pickle.loads(*", "*marshal.loads(*", "*binascii*",
"*dup2*", "*fileno()*", "*bind(*", "*execve(*", "*b64(*", "*b32(*", "*b16(*", "*b85(*", "*zlib.*",
"*[::-1]*", "*socket.socket(*", "*socket.connect(*", "*socket.bind(*", "*s.socket(*",
"*s.connect(*", "*s.bind(*", "*base64.b*decode(*", "*base64.b*encode(*", "*binascii.b64decode(*",
"*binascii.b64encode(*", "*import pty*", "*pty.spawn(*", "*pty.fork()*",
// PHP
"*system(*", "*shell_exec(*", "*passthru(*", "*proc_open(*", "*pcntl_exec(*", "*popen(*",
"*assert(*", "*preg_replace(*e*", "*include(*", "*require(*", "*move_uploaded_file(*",
"*base64_decode(*", "*gzinflate(*", "*gzuncompress(*", "*str_rot13(*", "*urldecode(*", "*chr(*",
"*ord(*", "*strrev(*", "*strtr(*", "*pack(*", "*curl_exec(*", "*curl_multi_exec(*",
"*file_get_contents(*", "*fopen(*", "*fsockopen(*", "*stream_socket_client(*", "*socket_create(*",
"*socket_connect(*", "*socket_write(*", "*socket_read(*", "*mail(*",
// Perl
"*spawn(*", "*load(*IO::*", "*load(*Marshal*", "*load(*Fiddle*", "*load(*Zlib*", "*load(*Base64*",
"*Fiddle.dlopen(*", "*Fiddle::Function.new(*", "*net/http*", "*open-uri*",
// Ruby
"*Marshal.load(*", "*open-uri*",
// Lua
"*os.execute(*", "*loadstring(*", "*dofile(*", "*package.loadlib(*", "*base64.decode(*",
"*base64.encode(*", "*socket.receive(*", "*socket.send(*", "*socket.tcp(*", "*socket.udp(*",
"*socket.listen(*", "*socket.accept(*", "*net.http.request(*", "*net.http.get(*", "*net.http.post(*",
"*http.request(*", "*http.get(*", "*http.post(*",
// Node.js
"""*require('child_process')*""", """*require("child_process")*""", "*child_process.exec*",
"*Buffer.from(*base64*", "*Buffer.from(*).toString(*)*", "*eval(*)*", "*Function(*)*"
) and not (
process.working_directory like (
"/var/lib/Acronis/mms", "/opt/varonis*", "/var/opt/ds_agent", "/opt/nessus_agent/*", "/var/opt/microsoft/omsagent/*",
"/tmp/plz_sandbox", "/builds/*", "/var/tmp/buildah*", "/opt/azurevstsagent/*", "/jenkins/*"
) or
process.executable like ("/var/lib/docker/*", "/tmp/newroot/*") or
process.parent.executable like (
"/tmp/newroot/*", "/tmp/.mount_Cursor*", "/tmp/petalinux_*", "/tmp/baum/easybuild/*", "/proc/*/ns/*",
"/tmp/.mount_cursor*/cursor", "/tmp/nsjail*", "/tmp/petalinux*", "/tmp/cmdickens/easybuild/*", "/tmp/cairosvg*",
"/tmp/petalinx_*"
) or
process.parent.command_line in ("runc init", "./python -m test --pgo --timeout=1200") or
process.command_line like ("*postinstall*", "/bin/sh -c node -e *require*nan*") or
(process.name like "python*" and process.command_line like "*require*nan*")
)
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/execution_java_xsl_template_creation_followed_by_shell_execution.toml
-75
View File
@@ -1,75 +0,0 @@
[rule]
description = """
This rule detects the creation of a Java XSL or XSLT template file followed by a shell execution. This behavior is
indicative of template injection attacks, where an attacker creates a malicious XSL/XSLT template to execute arbitrary
shell commands via the Java process.
"""
id = "a8aa81be-a4e2-408f-8041-faa9b4169807"
license = "Elastic License v2"
name = "Java XSL Template Creation Followed by Shell Execution"
os_list = ["linux"]
reference = [
"https://www.oracle.com/security-alerts/alert-cve-2025-61882.html",
"https://www.crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882/",
]
version = "1.0.4"
query = '''
sequence with maxspan=1m
[file where event.type == "creation" and process.name == "java" and file.extension in ("xsl", "xslt")] by process.entity_id
[process where event.type == "start" and event.action == "exec" and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
process.args == "-c" and process.parent.name == "java" and process.working_directory like~ "/u0?/*" and user.id == 54321 and
not process.args like ("kill -0*", "kill -9*", "echo $$", "cd*", "ls*", "kill -15*", "test*", "ulimit*", "python3 workspace.py")
] by process.parent.entity_id
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[[threat.technique]]
id = "T1203"
name = "Exploitation for Client Execution"
reference = "https://attack.mitre.org/techniques/T1203/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/execution_javascript_reverse_shell_via_node.js.toml
+17 -2
View File
@@ -9,10 +9,10 @@ id = "88c1728e-2d2e-48ff-9c77-a084efdd4498"
license = "Elastic License v2"
name = "Javascript Reverse Shell via Node.js"
os_list = ["linux"]
version = "1.0.4"
version = "1.0.5"
query = '''
sequence by process.entity_id with maxspan=1m
sequence by process.entity_id with maxspan=10s
[process where event.type == "start" and event.action == "exec" and process.name == "node" and
process.args == "node" and process.args_count == 2 and process.args : (
"/tmp/*.js", "/var/tmp/*.js", "/dev/shm/*.js", "/tmp/*.mjs", "/var/tmp/*.mjs", "/dev/shm/*.mjs"
@@ -35,6 +35,21 @@ optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1
[[threat]]
behavior/rules/linux/execution_linux_background_process_execution_via_shell.toml
+13 -6
View File
@@ -7,16 +7,18 @@ id = "21692d53-d4a5-462c-9ee6-2d8788411996"
license = "Elastic License v2"
name = "Linux Background Process Execution via Shell"
os_list = ["linux"]
version = "1.0.7"
version = "1.0.8"
query = '''
process where event.action == "exec" and event.type == "start" and
process where event.type == "start" and event.action == "exec" and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args == "-c" and
process.args : ("/* &", "/*&") and process.args_count == 3 and
process.parent.executable : ("/dev/shm/*", "/var/tmp/*", "/tmp/*", "/var/www/*") and not (
process.executable : "/tmp/newroot/*" or
process.args like ("/* &", "/*&") and process.args_count == 3 and
process.parent.executable like ("/dev/shm/*", "/var/tmp/*", "/tmp/*", "/var/www/*") and
not (
process.executable like "/tmp/newroot/*" or
process.command_line == "/bin/bash -c /opt/forticlient/fortitray &" or
process.parent.executable : ("/var/www/splynx/*", "/tmp/.mount_cursor*")
process.parent.executable like ("/var/www/splynx/*", "/tmp/.mount_cursor*", "/tmp/newroot/*") or
process.parent.args == "cursor"
)
'''
@@ -27,6 +29,11 @@ action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
behavior/rules/linux/execution_linux_hidden_folder_or_file_execution_via_python.toml
+19 -6
View File
@@ -8,16 +8,24 @@ license = "Elastic License v2"
name = "Linux Hidden Folder or File Execution via Python"
os_list = ["linux"]
reference = ["https://github.com/rapid7/metasploit-framework"]
version = "1.0.13"
version = "1.0.14"
query = '''
process where event.type == "start" and event.action == "exec" and
process.executable like~ ("/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*") and
process.args : "python*" and process.args : ("/tmp/.*", "/var/tmp/.*", "/dev/shm/.*") and
not process.parent.name in ("browser_tests", "unit_tests", "arduino-cli", "node", "python.original") and
not process.args like ("/tmp/.build/*", "/tmp/.sentrycli*", "/var/tmp/.mount_GIMP*", "/tmp/.mount_GIMP*", "/tmp/*/ansible-tmp-*/AnsiballZ*.py", "/tmp/selfgz*.py") and
not (process.parent.executable like "/home/*/node_modules/@openai/codex/bin/codex-x86_64-unknown-linux-musl" and process.command_line like "python3 /tmp/.tmp*") and
not (process.args == "/usr/bin/ukify" and process.args == "build")
process.args : "python*" and process.args : ("/tmp/.*", "/var/tmp/.*", "/dev/shm/.*") and
not (
process.parent.name in ("browser_tests", "unit_tests", "arduino-cli", "node", "python.original") or
process.args like (
"/tmp/.build/*", "/tmp/.sentrycli*", "/var/tmp/.mount_GIMP*", "/tmp/.mount_GIMP*", "/tmp/*/ansible-tmp-*/AnsiballZ*.py",
"/tmp/selfgz*.py"
) or
(
process.parent.executable like "/home/*/node_modules/@openai/codex/bin/codex-x86_64-unknown-linux-musl" and
process.command_line like "python3 /tmp/.tmp*"
) or
(process.args == "/usr/bin/ukify" and process.args == "build")
)
'''
min_endpoint_version = "7.15.0"
@@ -27,6 +35,11 @@ action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
behavior/rules/linux/execution_linux_powershell_egress_network_connection.toml
+14 -4
View File
@@ -7,19 +7,19 @@ id = "1471cf36-7e5c-47cc-bf39-2234df0e676a"
license = "Elastic License v2"
name = "Linux Powershell Egress Network Connection"
os_list = ["linux"]
version = "1.0.12"
version = "1.0.13"
query = '''
sequence by process.entity_id with maxspan=5s
[process where event.type == "start" and event.action == "exec" and process.parent.name : "pwsh" and not (
[process where event.type == "start" and event.action == "exec" and process.parent.name == "pwsh" and not (
process.name in ("kubectl", "helm", "pwsh", "yum", "dnf", "dotnet", "ansible-lint") or
process.executable like (
"/run/containerd/*python3", "/jenkins-data/docker/*python3", "/tmp/Download-References/DepotDownloader/DepotDownloader",
"/home/*/.local/bin/az"
"/home/*/.local/bin/az", "/usr/libexec/platform-python*"
) or
process.parent.executable like ("/jenkins-data/docker*", "/var/run/docker/*", "/run/containerd/*") or
process.command_line == "/usr/bin/gh auth status" or
(process.name like~ "python*" and process.args == "azure.cli") or
(process.name like "python*" and process.args == "azure.cli") or
process.working_directory like "/opt/azurevstsagent/agent*" or
process.args == "/bin/dnf"
)
@@ -46,11 +46,21 @@ action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
behavior/rules/linux/execution_linux_powershell_encoded_command.toml
+9 -3
View File
@@ -8,15 +8,16 @@ id = "cd6e64ec-2890-4bd8-9d07-bef06465b06f"
license = "Elastic License v2"
name = "Linux Powershell Encoded Command"
os_list = ["linux"]
version = "1.0.14"
version = "1.0.15"
query = '''
process where event.action == "exec" and event.type == "start" and process.name == "pwsh" and
process.args : ("-EncodedCommand", "-enc", "-E") and process.args : ("-nop", "-noprofile") and
length(process.command_line) >= 100 and not (
process.parent.name in ("node", "code", "code-insiders", "cursor") or
process.parent.args : "*Invoke-Pester*" or
process.parent.executable like "/data/user/docker/*" or
process.parent.command_line : "*Invoke-Pester*" or
process.parent.args == "--utility-sub-type=node.mojom.NodeService" or
process.parent.executable like ("/data/user/docker/*", "/tmp/.mount_Cursor*/usr/share/cursor/cursor") or
process.parent.executable in ("/usr/lib/electron30/electron", "/usr/lib/electron32/electron", "/tmp/newroot/proc/self/exe") or
(
process.args == "IAAoAEcAZQB0AC0ASABvAHMAdAApAC4AVgBlAHIAcwBpAG8AbgAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAA=" and
@@ -37,6 +38,11 @@ action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
behavior/rules/linux/execution_linux_powershell_suspicious_child_process.toml
+13 -6
View File
@@ -7,15 +7,17 @@ id = "e9731cea-c3fc-4183-a76c-9a798ae0a2b0"
license = "Elastic License v2"
name = "Linux Powershell Suspicious Child Process"
os_list = ["linux"]
version = "1.0.8"
version = "1.0.9"
query = '''
process where event.type == "start" and event.action == "exec" and process.parent.name : "pwsh" and process.name : (
"nc", "ncat", "netcat", "socat", "nc.openbsd", "ngrok", "ping", "python*", "php*", "perl", "ruby", "lua*", "openssl",
process where event.type == "start" and event.action == "exec" and process.parent.name == "pwsh" and
process.name like (
"nc", "ncat", "netcat", "socat", "nc.openbsd", "ngrok", "ping", "python*", "php*", "perl*", "ruby*", "lua*", "openssl",
"telnet"
) and not (
(process.name : "python*" and process.args == "azure.cli") or
process.parent.executable : (
) and
not (
(process.name like "python*" and process.args == "azure.cli") or
process.parent.executable like~ (
"/opt/ansible*/Evaluate-STIG/powershell/pwsh", "/evaluate/Evaluate-STIG/powershell/pwsh",
"/opt/Evaluate-STIG/powershell/pwsh"
) or
@@ -30,6 +32,11 @@ action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
behavior/rules/linux/execution_linux_reverse_shell.toml
+18 -3
View File
@@ -8,12 +8,12 @@ license = "Elastic License v2"
name = "Linux Reverse Shell"
os_list = ["linux"]
reference = ["https://www.elastic.co/security-labs/primer-on-persistence-mechanisms"]
version = "1.0.7"
version = "1.0.8"
query = '''
sequence with maxspan=5s
[network where event.type == "start" and event.action in ("connection_attempted", "connection_accepted") and
process.name : ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "socat") and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "socat") and
not (destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
"192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
@@ -24,7 +24,7 @@ sequence with maxspan=5s
)] by process.entity_id
[process where event.type == "start" and event.action in ("exec", "fork") and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and (
(process.args : ("-i", "-l")) or (process.parent.name == "socat" and process.parent.args : "*exec*")
(process.args in ("-i", "-il", "-li")) or (process.parent.name == "socat" and process.parent.command_line like~ "*exec*")
)] by process.parent.entity_id
'''
@@ -35,6 +35,21 @@ action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
behavior/rules/linux/execution_linux_reverse_shell_via_child.toml
+20 -3
View File
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "Linux Reverse Shell via Child"
os_list = ["linux"]
reference = ["https://www.elastic.co/security-labs/primer-on-persistence-mechanisms"]
version = "1.0.6"
version = "1.0.7"
query = '''
sequence by process.entity_id with maxspan=5s
@@ -17,8 +17,10 @@ sequence by process.entity_id with maxspan=5s
not cidrmatch(destination.ip, "127.0.0.0/8", "169.254.0.0/16", "224.0.0.0/4", "::1")]
[process where event.type == "start" and event.action == "exec" and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and (
(process.args in ("-i", "-l")) or (process.parent.name == "socat" and process.parent.args like "*exec*")
)]
process.args in ("-i", "-il", "-li") or
(process.parent.name == "socat" and process.parent.command_line like~ "*exec*")
)
]
'''
min_endpoint_version = "8.5.0"
@@ -28,6 +30,21 @@ action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
behavior/rules/linux/execution_linux_reverse_shell_via_netcat.toml
+19 -4
View File
@@ -8,14 +8,14 @@ license = "Elastic License v2"
name = "Linux Reverse Shell via netcat"
os_list = ["linux"]
reference = ["https://www.elastic.co/security-labs/primer-on-persistence-mechanisms"]
version = "1.0.6"
version = "1.0.7"
query = '''
sequence by process.entity_id with maxspan=5s
[process where event.type == "start" and event.action == "exec" and
process.name : ("nc", "ncat", "netcat", "nc.openbsd") and process.args_count >= 3 and
process.parent.name : ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args == "-e" and
not process.args : ("-*z*", "-*l*")]
process.name in ("nc", "ncat", "netcat", "nc.openbsd") and process.args_count >= 3 and
process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args == "-e" and
not process.args like~ ("-*z*", "-*l*")]
[network where event.type == "start" and event.action in ("connection_attempted", "connection_accepted") and
process.name in ("nc", "netcat", "ncat", "nc.openbsd") and
not (destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
@@ -35,6 +35,21 @@ action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
behavior/rules/linux/execution_linux_reverse_shell_via_setsid_and_nohup.toml
+17 -2
View File
@@ -9,13 +9,13 @@ license = "Elastic License v2"
name = "Linux Reverse Shell via setsid and nohup"
os_list = ["linux"]
reference = ["https://www.elastic.co/security-labs/primer-on-persistence-mechanisms"]
version = "1.0.4"
version = "1.0.5"
query = '''
sequence by process.entity_id with maxspan=3s
[network where event.type == "start" and event.action == "connection_attempted" and (
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "nc", "ncat", "netcat", "nc.openbsd") or
process.name : ("python*", "php*", "perl", "ruby*", "lua*")
process.name like ("python*", "php*", "perl", "ruby*", "lua*")
) and not (destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
"192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
@@ -30,11 +30,26 @@ sequence by process.entity_id with maxspan=3s
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
behavior/rules/linux/execution_linux_reverse_shell_via_suspicious_utility.toml
+22 -12
View File
@@ -10,29 +10,29 @@ license = "Elastic License v2"
name = "Linux Reverse Shell via Suspicious Utility"
os_list = ["linux"]
reference = ["https://www.elastic.co/security-labs/primer-on-persistence-mechanisms"]
version = "1.0.8"
version = "1.0.9"
query = '''
sequence by process.entity_id with maxspan=10s
[process where event.type == "start" and event.action in ("fork", "exec") and (
(process.name : "python*" and process.args : "-c" and process.args : (
sequence by process.entity_id with maxspan=5s
[process where event.type == "start" and event.action == "exec" and (
(process.name like "python*" and process.args == "-c" and process.command_line like~ (
"*import*pty*spawn*", "*import*subprocess*call*"
)) or
(process.name : "perl*" and process.args : "-e" and process.args : "*socket*" and process.args : (
(process.name like "perl*" and process.args == "-e" and process.command_line like~ "*socket*" and process.command_line like~ (
"*exec*", "*system*"
)) or
(process.name : "ruby*" and process.args : ("-e", "-rsocket") and process.args : (
(process.name like "ruby*" and process.args in ("-e", "-rsocket") and process.command_line like~ (
"*TCPSocket.new*", "*TCPSocket.open*"
)) or
(process.name : "lua*" and process.args : "-e" and process.args : "*socket.tcp*" and process.args : (
(process.name like "lua*" and process.args == "-e" and process.command_line like~ "*socket.tcp*" and process.command_line like~ (
"*io.popen*", "*os.execute*"
)) or
(process.name : "php*" and process.args : "-r" and process.args : "*fsockopen*" and process.args : "*/bin/*sh*") or
(process.name == "node" and process.args == "-e" and process.args : "*spawn*sh*" and process.args : "*connect*") or
(process.name : ("awk", "gawk", "mawk", "nawk") and process.args : "*/inet/tcp/*")
(process.name like "php*" and process.args == "-r" and process.command_line like~ "*fsockopen*" and process.command_line like~ "*/bin/*sh*") or
(process.name == "node" and process.args == "-e" and process.command_line like~ "*spawn*sh*" and process.command_line like~ "*connect*") or
(process.name in ("awk", "gawk", "mawk", "nawk") and process.command_line like~ "*/inet/tcp/*")
)]
[network where event.type == "start" and event.action in ("connection_attempted", "connection_accepted") and
process.name : ("python*", "php*", "perl", "ruby", "lua*", "*awk", "node") and not (
[network where event.type == "start" and event.action == "connection_attempted" and
process.name like ("python*", "php*", "perl", "ruby", "lua*", "*awk", "node") and not (
destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
"192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
@@ -50,11 +50,21 @@ action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
behavior/rules/linux/execution_linux_suspicious_child_process_execution_via_interactive_shell.toml
-78
View File
@@ -1,78 +0,0 @@
[rule]
description = """
Detects when a process is executed via an interactive shell. C2 platforms will commonly spawn an interactive shell
providing the threat actor with a remote shell on the system as if they were physically at the terminal allowing them to
send and execute commands manually.
"""
id = "aa02591f-c9e6-4317-841e-0b075b9515ff"
license = "Elastic License v2"
name = "Linux Suspicious Child Process Execution via Interactive Shell"
os_list = ["linux"]
version = "1.0.17"
query = '''
process where event.type == "start" and event.action == "exec" and process.args like "-i" and process.args_count <= 2 and
process.name in ("bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.parent.args_count > 1 and
process.parent.name like (
"bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "python*", "php*", "socat",
"perl", "ruby", "lua*", "openssl", "nc", "netcat", "ncat", "telnet", "awk", "node"
) and not (
process.parent.args like (
"echo*| sudo -S su; sudo su;*SHELL -i", "/usr/share/kali-menu/exec-in-shell", "/usr/bin/kali-treecd", "pipenv",
"/usr/scratch/xar/23e8559c/bin/python"
) or
process.parent.command_line in ("/bin/sh -c bash -i </dev/tty >/dev/tty 2>/dev/tty", "/bin/bash --login --posix") or
process.parent.command_line like (
"/usr/scratch/*poetry shell", "*/u01/app/oracle.ahf/tfa/internal/tmp/*.sh*", "*/opt/oracle/oracle.ahf/tfa/internal/*.sh*",
"bash -c ls -al; $SHELL -i", "bash -c cd ~/GIT/salt/pillars; $SHELL -i", "bash -c cd ~/GIT/ansible-infra; $SHELL -i",
"bash -c cd ~/GIT/salt/states; $SHELL -i", "bash -c cd ~/GIT/puppet/hieradata; $SHELL -i",
"bash -c cd ~/GIT/puppet/ind_legacy; $SHELL -i"
) or
process.command_line == "/opt/cursor.appimage -i" or
process.parent.executable like (
"/mnt/*/.vscode-server/bin/*/node", "/vscode/vscode-server/bin/*/node", "/home/*/.vscode-server/bin/*/node",
"/usr/scratch/*/.vscode-server/bin/*/node", "/home/*/.vscode-server/*/server/node", "/scratch/user/*/.vscode-server/cli/servers/*/server/node"
) or
(process.parent.command_line like ("*pipenv*", "*poetry*") and process.parent.args:"shell")
)
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/execution_netcat_reverse_shell_via_busybox.toml
+12 -2
View File
@@ -8,12 +8,12 @@ id = "332a8018-6615-4d2d-aeff-61e85e5ae77b"
license = "Elastic License v2"
name = "Netcat Reverse Shell via Busybox"
os_list = ["linux"]
version = "1.0.6"
version = "1.0.7"
query = '''
sequence by process.entity_id with maxspan=5s
[process where event.type == "start" and event.action == "exec" and process.name == "busybox" and
process.args like ("* nc *", "* netcat *", "* ncat *") and not process.args like "-*z*"]
process.command_line like ("* nc *", "* netcat *", "* ncat *") and not process.args like "-*z*"]
[network where event.type == "start" and event.action == "connection_attempted" and process.name == "busybox" and
not (destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
@@ -28,11 +28,21 @@ sequence by process.entity_id with maxspan=5s
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
behavior/rules/linux/execution_outbound_network_connection_followed_by_process_file_deletion.toml
+15 -3
View File
@@ -9,12 +9,13 @@ id = "e64787a1-801e-48d2-a09e-d474bba68197"
license = "Elastic License v2"
name = "Outbound Network Connection Followed by Process File Deletion"
os_list = ["linux"]
version = "1.0.5"
version = "1.0.6"
query = '''
sequence by process.parent.entity_id with maxspan=10s
[network where event.type == "start" and event.action == "connection_attempted" and
process.executable like ("/tmp/*", "/var/tmp/*", "/dev/shm/*") and not (
process.executable like ("/tmp/*", "/var/tmp/*", "/dev/shm/*") and
not (
destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
"192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
@@ -25,7 +26,8 @@ sequence by process.parent.entity_id with maxspan=10s
process.executable like (
"/tmp/regctl", "/tmp/token_handler", "/tmp/tmp.*/juliainstaller", "/tmp/tmp.*/rustup-init",
"/tmp/tmp.*/elan-init", "/var/tmp/tmp.*/rustup-init", "/tmp/SophosCentralInstall*/bin/telemetry",
"/tmp/bdconfigure.*/bdconfigure64"
"/tmp/bdconfigure.*/bdconfigure64", "/tmp/nanolayer*/nanolayer", "/tmp/tmp.*/pgp-file-protect",
"/tmp/tmp.*/rover", "/tmp/tmp.*/sq-ccm", "/tmp/trizen-fric/jfrog-cli/src/jfrog-cli-*/jf"
)
)] as event0
[file where event.type == "deletion" and process.name == "rm" and startswith~(file.path, event0.process.executable)]
@@ -38,11 +40,21 @@ action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
behavior/rules/linux/execution_potential_gsocket_activity.toml
+4 -4
View File
@@ -10,15 +10,15 @@ license = "Elastic License v2"
name = "Potential Gsocket Activity"
os_list = ["linux"]
reference = ["https://github.com/hackerschoice/gsocket", "https://www.gsocket.io/", "https://www.thc.org/ssh-it/"]
version = "1.0.7"
version = "1.0.8"
query = '''
process where event.type == "start" and event.action == "exec" and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
process.command_line : (
process.command_line like~ (
"*GS_ARGS=*", "*gs-netcat*", "*gs-sftp*", "*gs-mount*", "*gs-full-pipe*", "*GS_NOINST=*", "*GSOCKET_ARGS=*",
"*GS_DSTDIR=*", "*GS_URL_BASE=*", "*GS_OSARCH=*", "*GS_DEBUG=*", "*GS_HIDDEN_NAME=*", "*GS_HOST=*",
"*GS_PORT=*", "*GS_TG_TOKEN=*", "*GS_TG_CHATID=*", "*GS_DISCORD_KEY=*", "*GS_WEBHOOK_KEY=*"
"*GS_DSTDIR=*", "*GS_URL_BASE=*", "*GS_OSARCH=*", "*GS_HIDDEN_NAME=*", "*GS_HOST=*",
"* GS_PORT=*", "*GS_TG_TOKEN=*", "*GS_TG_CHATID=*", "*GS_DISCORD_KEY=*", "*GS_WEBHOOK_KEY=*"
) and not (
process.parent.name in ("make", "ninja", "qmake", "gmake") or
process.parent.executable like ("/tmp/newroot/nix/store/*/generator/generator", "/usr/share/cursor/cursor") or
behavior/rules/linux/execution_potential_redishell_(cve_2025_49844)_exploitation.toml
-75
View File
@@ -1,75 +0,0 @@
[rule]
description = """
RediShell (CVE-2025-49844) is a critical (CVSS 10.0) use-after-free flaw in Redis' Lua handling that allows a post-auth
attacker to submit a crafted Lua script which breaks out of the built-in sandbox and executes native code on the host.
Exploitation yields remote code execution and can lead to full host compromise. This rule flags a behavioral pattern
consistent with exploitation: Redis (processes running as redis, children or descendants of redis-server) spawning an
executable named lua* within a short time window — a strong heuristic for on-host Lua interpreter invocation or a
sandbox escape that launches follow-on native payloads.
"""
id = "86c3a1a0-b3ca-4d4a-a7ee-f890ac12a48b"
license = "Elastic License v2"
name = "Potential RediShell (CVE-2025-49844) Exploitation"
os_list = ["linux"]
reference = ["https://www.wiz.io/blog/wiz-research-redis-rce-cve-2025-49844"]
version = "1.0.2"
query = '''
sequence by process.entity_id with maxspan=10s
[process where event.type == "start" and event.action == "exec" and (
(process.parent.name == "redis-server") or
(user.name == "redis") or
(descendant of [process where process.name == "redis-server"])
)]
[process where event.type == "start" and event.action == "exec" and process.name like~ "lua*"]
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[[threat.technique]]
id = "T1203"
name = "Exploitation for Client Execution"
reference = "https://attack.mitre.org/techniques/T1203/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/execution_potential_remote_code_execution_via_langflow.toml
+6 -1
View File
@@ -10,7 +10,7 @@ license = "Elastic License v2"
name = "Potential Remote Code Execution via Langflow"
os_list = ["linux"]
reference = ["https://nvd.nist.gov/vuln/detail/CVE-2025-3248", "https://github.com/verylazytech/CVE-2025-3248"]
version = "1.0.3"
version = "1.0.4"
query = '''
process where event.type == "start" and event.action == "exec" and process.parent.name == "langflow" and
@@ -24,6 +24,11 @@ action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
behavior/rules/linux/execution_potential_reverse_shell_via_named_pipe.toml
-93
View File
@@ -1,93 +0,0 @@
[rule]
description = """
This rule detects the creation of a reverse shell through the use of named pipes. Attackers may leverage named pipes to
evade detection and establish persistence onto a target system.
"""
id = "40bec6eb-e93b-4d09-8265-66bba186e332"
license = "Elastic License v2"
name = "Potential Reverse Shell via Named Pipe"
os_list = ["linux"]
version = "1.0.13"
query = '''
sequence by process.parent.entity_id with maxspan=1m
[process where event.type == "start" and event.action == "exec" and process.name in ("mkfifo", "mknod") and
process.parent.command_line regex~ ".*[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.*" and not (
process.executable like "/var/lib/docker/*" or
process.parent.name in ("code", "nvim") or
process.parent.args in (
"check-trigger.sh", "load-fas-final.sh", "load-kpi-history.sh", "load-fas-table.sh", "load-kpi-gsheet.sh"
) or
process.parent.executable in (
"/opt/azure/containers/aks-log-collector.sh", "/usr/sbin/debootstrap", "/usr/share/boot-sav/boot-repair.sh",
"/usr/lib/systemd/systemd"
) or
process.parent.command_line in (
"/bin/sh -c cd GSheetLoad && bash load-fas-table.sh",
"/bin/sh -c cd GSheetLoad && bash check-trigger.sh",
"sh /usr/bin/_entrypoint.sh"
) or
process.parent.command_line like "*Datadog*" or
process.command_line == "mkfifo /tmp/newrelic-infra.log" or
process.args like (
"collect/ss_stats.txt", "/tmp/tmp.*", "collect/ss.txt", "collect/sysctl.txt", "collect/systemctl-status.txt",
"/home/jetson/Linux_for_Tegra/rootfs/dev/urandom", "/run/exabgp/exabgp.out", "/dev/vboxusb/*",
"/var/tmp/.oracle/npohasd*", "/var/tmp/dracut*", "/tmp/.criu*", "/vz/*", "/var/log/misp_upgrade.log.pipe",
"/home/vscode/cedar-dev-environment/cedar/venv/bin/python"
) or
process.command_line like ("mknod /tmp/*.tmp p", "mkfifo /run/user/*") or
(
process.parent.executable == "./agent-linux-x86_64.sh" and
process.command_line like "mkfifo /tmp/agent-linux-x86_64.sh.pipe.*"
) or
(process.parent.executable == "/usr/bin/nvim" and process.command_line like "mkfifo /tmp/nvim.favilo/*") or
(process.name == "node" and process.args like~ "/run/user/*/python-test-discovery-*")
)
]
[network where event.type == "start" and event.action == "connection_attempted" and not (
destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
"192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
"192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
"192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
"FF00::/8", "172.31.0.0/16"
) or
process.executable == "/usr/share/windsurf/resources/app/extensions/windsurf/bin/language_server_linux_x64"
)
]
'''
min_endpoint_version = "8.7.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "8.7.0"
behavior/rules/linux/execution_printer_user_(lp)_shell_execution.toml
-63
View File
@@ -1,63 +0,0 @@
[rule]
description = """
This detection rule addresses multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176,
CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Specifically, this rule detects shell executions from the
foomatic-rip parent process through the default printer user (lp). These flaws impact components like cups-browsed,
libcupsfilters, libppd, and foomatic-rip, allowing remote unauthenticated attackers to manipulate IPP URLs or inject
malicious data through crafted UDP packets or network spoofing. This can result in arbitrary command execution when a
print job is initiated.
"""
id = "54873ebe-b8c8-4053-92b2-8ee8f57aabc1"
license = "Elastic License v2"
name = "Printer User (lp) Shell Execution"
os_list = ["linux"]
reference = [
"https://www.elastic.co/security-labs/cups-overflow",
"https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/",
"https://gist.github.com/stong/c8847ef27910ae344a7b5408d9840ee1",
"https://github.com/RickdeJager/cupshax/blob/main/cupshax.py",
]
version = "1.0.6"
query = '''
process where event.type == "start" and event.action == "exec" and user.name == "lp" and
process.parent.name in ("cupsd", "foomatic-rip", "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and not (
process.command_line like (
"*/tmp/foomatic-*", "*-sDEVICE=ps2write*", "*printf*", "/bin/sh -e -c cat", "/bin/bash -c cat",
"/bin/bash -e -c cat", "/bin/sh -e -c pdftops*"
) or
process.args like (
"gs*", "/usr/lib/cups/filter/gstopdf", "/usr/lib/cups/filter/gstopxl", "/usr/lib/cups/filter/XeroxOfficeQScript",
"/usr/bin/foo2zjs-wrapper", "/usr/bin/foo2zjs-pstops", "foo2zjs-wrapper*"
)
)
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1203"
name = "Exploitation for Client Execution"
reference = "https://attack.mitre.org/techniques/T1203/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/execution_pseudoterminal_(pty)_creation_from_suspicious_executable.toml
+5 -2
View File
@@ -10,14 +10,17 @@ id = "bc695d3c-1ae0-485f-8c65-d6adb4a2759b"
license = "Elastic License v2"
name = "Pseudoterminal (PTY) Creation from Suspicious Executable"
os_list = ["linux"]
version = "1.0.4"
version = "1.0.5"
query = '''
sequence by process.entity_id with maxspan=10s
[process where event.type == "start" and event.action == "exec" and
process.executable like ("/dev/shm/*", "/tmp/*", "/var/tmp/*") and not (
process.executable like "/tmp/ubuntu-release-upgrader-*/jammy" or
process.working_directory like ("/scratch/*", "/tmp/ubuntu-release-upgrader-*", "/tmp/newroot/*")
process.working_directory like (
"/scratch/*", "/tmp/ubuntu-release-upgrader-*", "/tmp/newroot/*",
"/tmp/vscode-cli-*", "/tmp/.mount_*", "/tmp/cmdickens/easybuild/*"
)
)]
[file where event.type == "creation" and file.path == "/dev/ptmx"]
'''
behavior/rules/linux/execution_recently_downloaded_file_made_executable_and_run.toml
+5 -3
View File
@@ -9,7 +9,7 @@ id = "d67ef864-5567-4675-b2eb-7dfd4443e8af"
license = "Elastic License v2"
name = "Recently Downloaded File Made Executable and Run"
os_list = ["linux"]
version = "1.0.5"
version = "1.0.6"
query = '''
sequence by process.parent.entity_id with maxspan=10s
@@ -31,7 +31,7 @@ sequence by process.parent.entity_id with maxspan=10s
) and
process.args_count >= 2 and
stringcontains(process.command_line, event0.file.name) and
not process.args like~ ("*-h*","*--help*","*-V*","*--version*")]
not process.command_line like~ ("*-h*","*--help*","*-V*","*--version*")]
[process where event.type == "start" and event.action == "exec" and startswith~(process.executable, event0.file.path) and
not (
process.parent.executable == "/usr/local/bin/check_idle.sh" or
@@ -39,7 +39,9 @@ sequence by process.parent.entity_id with maxspan=10s
"/var/lib/docker/*", "/tmp/tmp.*/rustup-init", "/tmp/cis-diagnose-rc-amd64", "/tmp/tmp.*/juliainstaller",
"/etc/actions-runner-*", "/builds/*/snyk"
) or
(process.executable like "/tmp/teleport-*/install.sh" and process.args like "/usr/bin/env" and process.working_directory like "/tmp/teleport-*")
(process.executable like "/tmp/teleport-*/install.sh" and process.args == "/usr/bin/env" and process.working_directory like "/tmp/teleport-*") or
(process.executable == "/tmp/garage" and process.parent.args == "/garage-init") or
process.working_directory like "/var/lib/waagent/*"
)]
'''
behavior/rules/linux/execution_renice_or_ulimit_execution_from_unusual_parent.toml
+5 -4
View File
@@ -9,16 +9,17 @@ id = "57ed0e43-643a-47f3-936e-138dc6f480da"
license = "Elastic License v2"
name = "Renice or Ulimit Execution from Unusual Parent"
os_list = ["linux"]
version = "1.0.7"
version = "1.0.8"
query = '''
process where event.type == "start" and event.action == "exec" and (
process.name in ("ulimit", "renice") or (
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args == "-c" and
process.args like ("*ulimit*", "*renice*")
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args == "-c" and
process.command_line like ("*ulimit*", "*renice*")
)
) and process.parent.executable != null and
(process.parent.executable like ("/tmp/*", "/var/tmp/*", "/dev/shm/*") or process.parent.name like ".*") and not (
(process.parent.executable like ("/tmp/*", "/var/tmp/*", "/dev/shm/*") or process.parent.name like ".*") and
not (
process.parent.command_line in ("/bin/sh /usr/bin/byobu-status tmux_right", "runc init") or
process.parent.executable like (
"/tmp/newroot/*", "/tmp/vmis.*/vmware-installer/vmis-launcher", "/tmp/baum/easybuild/*", "/tmp/wbrashear/easybuild/*",
behavior/rules/linux/execution_reverse_or_bind_shell_via_suspicious_utility.toml
+5 -5
View File
@@ -11,14 +11,14 @@ reference = [
"https://gtfobins.github.io/#+non-interactive%20bind%20shell",
"https://gtfobins.github.io/#+non-interactive%20reverse%20shell",
]
version = "1.0.3"
version = "1.0.4"
query = '''
process where event.type == "start" and event.action == "exec" and (
(process.name == "nmap" and process.args : "--script=/tmp/tmp.*") or
(process.name : "lua*" and process.args == "-e" and process.args : "*socket*") or
(process.name in ("awk", "gawk", "nawk") and process.args : "*/inet/tcp*") or
(process.name in ("rvim", "vim", "vimdiff", "rview", "view") and process.args == "-c" and process.args : "*socket*")
(process.name == "nmap" and process.args like~ "--script=/tmp/tmp.*") or
(process.name like "lua*" and process.args == "-e" and process.command_line like~ "*socket*") or
(process.name in ("awk", "gawk", "nawk") and process.command_line like~ "*/inet/tcp*") or
(process.name in ("rvim", "vim", "vimdiff", "rview", "view") and process.args == "-c" and process.command_line like~ "*socket*")
)
'''
behavior/rules/linux/execution_reverse_shell_via_networkmanager_dispatcher_script.toml
+7 -2
View File
@@ -7,11 +7,11 @@ id = "50f67a77-d499-4f1f-8dfc-c47616b47a71"
license = "Elastic License v2"
name = "Reverse Shell via NetworkManager Dispatcher Script"
os_list = ["linux"]
version = "1.0.2"
version = "1.0.3"
query = '''
sequence with maxspan=5s
[process where event.type == "start" and event.action == "exec" and process.parent.executable like~ "/etc/NetworkManager/dispatcher.d/*"] by process.entity_id
[process where event.type == "start" and event.action == "exec" and process.parent.executable like "/etc/NetworkManager/dispatcher.d/*"] by process.entity_id
[network where event.type == "start" and event.action == "connection_attempted" and
not (destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
@@ -41,6 +41,11 @@ action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
behavior/rules/linux/execution_reverse_shell_via_node.js_descendant.toml
-82
View File
@@ -1,82 +0,0 @@
[rule]
description = """
This rule detects when a reverse shell is established via a descendant of a Node.js process. Attackers may use Node.js
to run scripts that create reverse shells for various malicious purposes, such as downloading and executing payloads,
establishing persistence, or exfiltrating data.
"""
id = "d9721d27-1f7a-45a5-a847-da76aa98b8d7"
license = "Elastic License v2"
name = "Reverse Shell via Node.js Descendant"
os_list = ["linux"]
version = "1.0.4"
query = '''
process where event.type == "start" and event.action == "exec" and (
process.parent.name == "node" or
descendant of [process where event.type == "start" and event.action == "exec" and process.name == "node"]
) and
(
(process.name : "python*" and process.args : "-c" and process.args : (
"*import*pty*spawn*", "*import*subprocess*call*", "*os.system*"
)) or
(process.name : "perl*" and process.args : "-e" and process.args : "*socket*" and process.args : (
"*exec*", "*system*"
)) or
(process.name : "ruby*" and process.args : ("-e", "-rsocket") and process.args : (
"*TCPSocket.new*", "*TCPSocket.open*"
)) or
(process.name : "lua*" and process.args : "-e" and process.args : "*socket.tcp*" and process.args : (
"*io.popen*", "*os.execute*"
)) or
(process.name : "php*" and process.args : "-r" and process.args : "*fsockopen*" and process.args : "*/bin/*sh*") or
(process.name == "node" and process.args == "-e" and process.args : "*spawn*sh*" and process.args : "*connect*") or
(process.name : ("awk", "gawk", "mawk", "nawk") and process.args : "*/inet/tcp/*") or
(process.name in ("socat", "nc", "ncat", "netcat", "nc.openbsd", "nc.traditional") and not process.args like "-*z*")
) and not (
process.command_line like ("*127.0.0.1*", "*localhost*") or
process.parent.executable like (
"/home/*/.local/bin/pip", "/plz-out/bin/cloud/tools/can-toolbox/publish-to-cws/publish-to-testers.sh"
) or
process.parent.command_line like "*/usr/tmp/claude-http-*.sock*"
)
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/execution_script_executed_through_unusual_parent_process.toml
+10 -5
View File
@@ -8,13 +8,18 @@ id = "133102a7-f906-4725-b382-09257a0209c2"
license = "Elastic License v2"
name = "Script Executed Through Unusual Parent Process"
os_list = ["linux"]
version = "1.0.8"
version = "1.0.9"
query = '''
process where event.type == "start" and event.action == "exec" and process.args_count == 1 and
process.name like ("perl*", "python*", "php*", "ruby*", "lua*") and (
process.parent.executable like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*", "/boot/*") or process.parent.name like ".*"
) and not (
process where event.type == "start" and event.action == "exec" and process.args_count == 1 and process.executable like (
"/bin/perl*", "/usr/bin/perl*", "/usr/local/bin/perl*",
"/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*",
"/bin/php*", "/usr/bin/php*", "/usr/local/bin/php*",
"/bin/ruby*", "/usr/bin/ruby*", "/usr/local/bin/ruby*",
"/bin/lua*", "/usr/bin/lua*", "/usr/local/bin/lua*"
) and
(process.parent.executable like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*", "/boot/*") or process.parent.name like ".*") and
not (
process.parent.executable like~ (
"/tmp/newroot/*", "./merged/*", "/var/tmp/.mount_*/AppRun", "/tmp/.mount_cursor*/usr/bin//cursor",
"/tmp/baum/easybuild/*/perl", "/var/tmp/buildah*", "/tmp/taddm/fileinfo*", "/tmp/wbrashear/easybuild/*",
behavior/rules/linux/execution_shell_via_networkmanager_dispatcher_script.toml
+2 -2
View File
@@ -7,11 +7,11 @@ id = "e8d8eb78-d6aa-456f-a24e-c073026f7809"
license = "Elastic License v2"
name = "Shell via NetworkManager Dispatcher Script"
os_list = ["linux"]
version = "1.0.2"
version = "1.0.3"
query = '''
process where event.type == "start" and event.action == "exec" and
process.parent.executable like~ "/etc/NetworkManager/dispatcher.d/*" and
process.parent.executable like "/etc/NetworkManager/dispatcher.d/*" and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")
'''
behavior/rules/linux/execution_suspicious_command_execution_via_busybox_proxy.toml
-85
View File
@@ -1,85 +0,0 @@
[rule]
description = """
This rule detects the execution of command line arguments capable of spawning shells or establishing network connections
through Busybox. Attackers may use this technique to execute commands while attempting to evade detection.
"""
id = "ad89ce4d-96df-4cc8-bfc5-979a73469b54"
license = "Elastic License v2"
name = "Suspicious Command Execution via Busybox Proxy"
os_list = ["linux"]
version = "1.0.16"
query = '''
process where event.type == "start" and event.action == "exec" and process.name == "busybox" and (
process.args in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
process.args : (
"*nc *", "*netcat*", "*openssl*", "*telnet*", "*exec*", "*import*pty*spawn*", "*import*subprocess*call*", "*socket*",
"*system*", "*io.popen*", "*os.execute*", "*fsockopen*", "*/inet/tcp/*", "*/dev/tcp/*", "*/dev/udp/*", "*nohup*",
"*setsid*", "*/dev/shm/*", "*ld-linux*.so*", "*/tmp/*", "*/var/tmp/*", "*rm*-rf*"
)
) and (
process.parent.executable like (
"/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*", "/run/*", "/var/run/*", "/boot/*", "/sys/*", "/lost+found/*",
"/proc/*", "/var/mail/*", "/var/www/*", "/home/*", "/root/*"
) or
process.parent.name like ".*"
) and not (
process.parent.command_line in ("runc init", "/usr/local/bin/runc init") or
process.parent.executable == "./runc" or
process.parent.executable like ("/run/containerd/io.containerd.runtime.v2.task/k8s.io/*/bin/php", "/tmp/go-build*.test") or
process.command_line == "sh -c echo EXEC" or
process.parent.name in ("ninja_test", "ocamlrun", "ocamlopt.opt", "make", "process-wrapper")
)
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/execution_suspicious_d_bus_method_call.toml
-67
View File
@@ -1,67 +0,0 @@
[rule]
description = """
This rule detects the execution of the dbus-send command with the `--type=method_call` argument, which is used to send a
method call to a D-Bus message bus. The D-Bus message bus is a system for inter-process communication (IPC) that allows
applications to communicate with each other. The dbus-send command is typically used to send messages to the D-Bus
message bus, which can be used to interact with other applications and services on the system. However, the dbus-send
command can also be used by attackers to execute arbitrary commands on the system or interact with other applications in
a malicious way.
"""
id = "6929ab87-7b2f-4ef8-858a-1f8f1c239cac"
license = "Elastic License v2"
name = "Suspicious D-Bus Method Call"
os_list = ["linux"]
version = "1.0.3"
query = '''
process where event.type == "start" and event.action == "exec" and process.name == "dbus-send" and
(process.args == "--type=method_call" or (process.args == "-t" and process.args == "method_call")) and
process.args in ("--system", "--session", "-y", "-s") and
process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.parent.args_count == 1 and not (
process.parent.executable like~ ("/home/*/.nix-profile/*", "/nix/store/*") or
process.args in (
"--dest=org.x.sticky", "--dest=com.vixalien.sticky", "--dest=org.gnome.SessionManager", "--dest=org.gnome.ScreenSaver",
"/io/elementary/terminal"
)
)
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/execution_suspicious_execution_from_foomatic_rip_or_cupsd_parent.toml
-75
View File
@@ -1,75 +0,0 @@
[rule]
description = """
This detection rule addresses multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176,
CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Specifically, this rule detects suspicious process command lines
executed by child processes of foomatic-rip and cupsd. These flaws impact components like cups-browsed, libcupsfilters,
libppd, and foomatic-rip, allowing remote unauthenticated attackers to manipulate IPP URLs or inject malicious data
through crafted UDP packets or network spoofing. This can result in arbitrary command execution when a print job is
initiated.
"""
id = "7c4d6361-3e7f-481a-9313-d1d1c0e5a3a9"
license = "Elastic License v2"
name = "Suspicious Execution from Foomatic-rip or Cupsd Parent"
os_list = ["linux"]
reference = [
"https://www.elastic.co/security-labs/cups-overflow",
"https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/",
"https://gist.github.com/stong/c8847ef27910ae344a7b5408d9840ee1",
"https://github.com/RickdeJager/cupshax/blob/main/cupshax.py",
]
version = "1.0.7"
query = '''
process where event.type == "start" and event.action == "exec" and process.parent.name in ("foomatic-rip", "cupsd") and
process.command_line like (
// persistence
"*cron*", "*/etc/rc.local*", "*/dev/tcp/*", "*/etc/init.d*", "*/etc/update-motd.d*", "*/etc/sudoers*",
"*/etc/profile*", "*autostart*", "*/etc/ssh*", "*/home/*/.ssh/*", "*/root/.ssh*", "*~/.ssh/*", "*udev*",
"*/etc/shadow*", "*/etc/passwd*",
// Downloads
"*curl*", "*wget*",
// encoding and decoding
"*base64 *", "*base32 *", "*xxd *", "*openssl*",
// reverse connections
"*GS_ARGS=*", "*/dev/tcp*", "*/dev/udp/*", "*import*pty*spawn*", "*import*subprocess*call*", "*TCPSocket.new*",
"*TCPSocket.open*", "*io.popen*", "*os.execute*", "*fsockopen*", "*disown*", "*nohup*",
// SO loads
"*openssl*-engine*.so*", "*cdll.LoadLibrary*.so*", "*ruby*-e**Fiddle.dlopen*.so*", "*Fiddle.dlopen*.so*",
"*cdll.LoadLibrary*.so*",
// misc. suspicious command lines
"*/etc/ld.so*", "*/dev/shm/*", "*/var/tmp*", "*echo*"
) and not (
process.args like "gs*" or
process.parent.executable == "/etc/init.d/cupsd" or
process.parent.command_line == "/sbin/openrc-run /etc/init.d/cupsd --lockfd 29 stop" or
process.working_directory == "/tmp/newroot"
)
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1203"
name = "Exploitation for Client Execution"
reference = "https://attack.mitre.org/techniques/T1203/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/execution_suspicious_execution_via_setsid_and_nohup.toml
+7 -2
View File
@@ -8,11 +8,11 @@ license = "Elastic License v2"
name = "Suspicious Execution via setsid and nohup"
os_list = ["linux"]
reference = ["https://www.elastic.co/security-labs/primer-on-persistence-mechanisms"]
version = "1.0.4"
version = "1.0.5"
query = '''
process where event.type == "start" and event.action == "exec" and process.name in ("setsid", "nohup") and
process.args : (
process.command_line like~ (
"*/dev/tcp*", "*/dev/udp/*", "*import*pty*spawn*", "*import*subprocess*call*", "*TCPSocket.new*", "*TCPSocket.open*",
"*io.popen*", "*os.execute*", "*fsockopen*", "*disown*"
)
@@ -25,6 +25,11 @@ action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
behavior/rules/linux/execution_suspicious_lua_command_execution.toml
+6 -4
View File
@@ -8,12 +8,13 @@ id = "5383342f-7ddd-46c6-90dc-349499df90f1"
license = "Elastic License v2"
name = "Suspicious Lua Command Execution"
os_list = ["linux"]
version = "1.0.4"
version = "1.0.5"
query = '''
process where event.type == "start" and event.action == "exec" and process.name like~ "lua*" and
process where event.type == "start" and event.action == "exec" and
process.executable like ("/bin/lua*", "/usr/bin/lua*", "/usr/local/bin/lua*") and
process.args == "-e" and process.command_line like~ (
"*os.execute(*", "*io.popen(*", "*load(*", "*loadstring(*", "*require(*", "*dofile(*",
"*os.execute(*", "*io.popen(*", "*load(*", "*loadstring(*", "*dofile(*",
"*package.loadlib(*", "*base64.decode(*", "*base64.encode(*", "*zlib.inflate(*",
"*zlib.deflate(*", "*zlib.decompress(*", "*zlib.compress(*", "*socket.bind(*",
"*socket.connect(*", "*socket.receive(*", "*socket.send(*", "*socket.tcp(*",
@@ -21,7 +22,8 @@ process.args == "-e" and process.command_line like~ (
"*net.http.get(*", "*net.http.post(*", "*http.request(*", "*http.get(*", "*http.post(*"
) and not (
process.parent.name in ("make", "configure") or
process.command_line in ("lua -e require('cjson')", "lua -e require('socket')")
process.command_line in ("lua -e require('cjson')", "lua -e require('socket')") or
process.command_line like "*no_such_lib*"
)
'''
behavior/rules/linux/execution_suspicious_mining_process_events.toml
+12 -14
View File
@@ -7,22 +7,20 @@ id = "fbf9342e-3d1e-4fba-a828-92fa0fb4d21b"
license = "Elastic License v2"
name = "Suspicious Mining Process Events"
os_list = ["linux"]
version = "1.0.25"
version = "1.0.26"
query = '''
process where event.action == "exec" and
((process.name=="service" and process.args=="stop") or
(process.name=="chkconfig" and process.args=="off") or
(process.name=="systemctl" and process.args in ("disable", "stop", "kill", "start", "reload", "restart"))) and
process.args in ("moneroocean_miner.service", "c3pool_miner.service", "pnsd.service", "apache4.service", "pastebin.service", "xvf.service") and
not (
/* exec via interactive shell */
process.parent.command_line : ("bash", "-bash", "sh") or
process.parent.executable : "/usr/local/share/aliyun-assist/*/update_install" or
process.parent.args like "/usr/local/share/aliyun-assist/*"
)
process where event.type == "start" and event.action == "exec" and (
(process.name == "service" and process.args == "stop") or
(process.name == "chkconfig" and process.args == "off") or
(process.name == "systemctl" and process.args in ("disable", "stop", "kill", "start", "reload", "restart"))
) and
process.args in ("moneroocean_miner.service", "c3pool_miner.service", "pnsd.service", "apache4.service", "pastebin.service", "xvf.service") and
not (
process.parent.command_line in ("bash", "-bash", "sh") or
process.parent.executable like "/usr/local/share/aliyun-assist/*/update_install" or
process.parent.args like "/usr/local/share/aliyun-assist/*"
)
'''
min_endpoint_version = "7.15.0"
behavior/rules/linux/execution_suspicious_perl_command_execution.toml
+6 -4
View File
@@ -8,7 +8,7 @@ id = "13c404cb-7631-4a33-8b59-5545e9a8a598"
license = "Elastic License v2"
name = "Suspicious Perl Command Execution"
os_list = ["linux"]
version = "1.0.10"
version = "1.0.11"
query = '''
process where event.type == "start" and event.action == "exec" and
@@ -23,12 +23,14 @@ process.args == "-e" and process.command_line like~ (
process.working_directory like~ ("/builds/*", "/root/.perl-cpm/*/MIME-tools-*", "/root/.cpan*", "/scratch/*") or
process.command_line like (
"perl -e eval { use MIME::Base64; print 1; }", "/home/*/bin/sendEmail*", "*transfer fish server*",
"""perl -e $|=1; print "### 100 transfer fish server\n"; while(<STDIN>) { last if /^__END__/; $code.=$_; } exit(eval($code))"""
"""perl -e $|=1; print "### 100 transfer fish server\n"; while(<STDIN>) { last if /^__END__/; $code.=$_; } exit(eval($code))""",
"*base64.h*", "*zlib.h*"
) or
process.parent.name in ("make", "filter_stderr") or
process.parent.executable like~ (
process.parent.executable like (
"/var/lib/docker/overlay2/*", "/usr/local/lp/apps/sonarpush-helpers/spectre-meltdown-checker.sh",
"/usr/sbin/debootstrap", "/usr/bin/xterm", "/usr/bin/xargs", "/var/lib/dpkg/info/sudo.postinst", "/usr/bin/gmake"
"/usr/sbin/debootstrap", "/usr/bin/xterm", "/usr/bin/xargs", "/var/lib/dpkg/info/sudo.postinst", "/usr/bin/gmake",
"/usr/bin/gxargs"
) or
process.parent.command_line like~ ("*testfun()*", "sh -c bash -c testfun*", "/usr/bin/perl t/utf8.t") or
process.parent.args in ("/usr/bin/parallel", "/usr/sbin/debootstrap")
behavior/rules/linux/execution_suspicious_php_command_execution.toml
+4 -3
View File
@@ -8,7 +8,7 @@ id = "d00bd50b-577e-47a7-9234-b4bfaa599791"
license = "Elastic License v2"
name = "Suspicious PHP Command Execution"
os_list = ["linux"]
version = "1.0.5"
version = "1.0.6"
query = '''
process where event.type == "start" and event.action == "exec" and process.parent.executable != null and
@@ -24,9 +24,10 @@ process.args == "-r" and process.command_line like~ (
) and not (
// Exclude web server processes as these are covered by other rules
process.working_directory like ("/var/www/*", "/builds/*", "/home/*/jenkins/*", "/home/*/public_html*") or
process.parent.args like "/var/www/html/*" or
process.parent.args like ("/var/www/html/*", "source /home/*/.claude/shell*") or
process.args like "/usr/local/cpanel/*" or
process.command_line like "*https://composer.github.io/installer.sig*"
process.command_line like "*https://composer.github.io/installer.sig*" or
process.parent.command_line == "runc init"
)
'''
behavior/rules/linux/execution_suspicious_python_command_execution.toml
-96
View File
@@ -1,96 +0,0 @@
[rule]
description = """
This rule monitors for suspicious Python command executions by detecting the start of a Python process with a command
line argument that contains keywords commonly used by attackers to execute malicious code. These command line arguments
include operations to execute code, create subprocesses, and encode or decode data.
"""
id = "028d01ae-bfbf-438e-a0d0-23aee55ea5c9"
license = "Elastic License v2"
name = "Suspicious Python Command Execution"
os_list = ["linux"]
version = "1.0.14"
query = '''
process where event.type == "start" and event.action == "exec" and
process.executable like~ ("/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*") and
process.args == "-c" and process.command_line like~ (
"*exec(*base64*", "*exec(*decode(*", "*exec(*marshal*", "*exec(*pickle*", "*eval(*exec(*",
"*eval(*", "*subprocess.popen(*", "*subprocess.run(*", "*pickle.loads(*", "*marshal.loads(*",
"*binascii*", "*os.system(*", "*os.popen(*", "*pty.*", "*dup2*", "*fileno()*", "*connect(*",
"*bind(*", "*execve(*", "*base64*", "*base32*", "*base16*", "*base85*", "*decode(*",
"*zlib.*", "*[::-1]*", "*socket.socket(*", "*socket.connect(*", "*socket.bind(*"
) and process.working_directory like (
"/var/www/*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/home/*", "/root/*"
) and not (
process.parent.args in ("pip", "install", "--pgo", "/tmp/portage/bin/pid-ns-init") or
process.parent.args like "/home/*/bin/join-zoom.sh" or
process.parent.name in ("pip", "pytest", "pip3", "sudo", "sshd", "teleport") or
process.executable like~ ("/var/lib/docker/*", "/tmp/plz_sandbox/*") or
process.command_line like (
"/usr/local/bin/python* -u -c import sys;exec(eval(sys.stdin.readline()))",
"/usr/bin/python* -u -c import sys;exec(eval(sys.stdin.readline()))",
"python -c import socket s = socket.socket(socket.AF_INET) s.bind(('127.0.0.1', 0)) _, listen_port = s.getsockname() s.close() print(listen_port)",
"*sqlite*", "*postgres*", "python -c import sys;import base64;sys.stdout.write('@Main\n');exec(base64.b64decode(sys.stdin.readline().rstrip()))#ZeroNetworks",
"""/usr/bin/python3 -c from tkinter import Tcl; print(Tcl().eval("info*"))""",
"python3*os.system*echo test*", "python3 -c import pymysql*",
"python3 -c import socket; s=socket.socket(); s.bind(('', 0)); print(s.getsockname()[1]); s.close()",
"python3 -c import socket; s=socket.socket(); s.bind(('0', 0)); print(s.getsockname()[1]); s.close()",
"python3 -c import socket; s=socket.socket(); s.bind(('0.0.0.0', 0)); print(s.getsockname()[1]); s.close()",
"python3 -c import socket; s=socket.socket(); s.bind(('localhost', 0)); print(s.getsockname()[1]); s.close()",
"import sys;sys.path=[p for p in sys.path if p];import binascii,os,zlib;exec(zlib.decompress(binascii.a2b_base64(*",
"*Thomas Nagy*"
) or
process.parent.executable like~ (
"/var/lib/amazon/ssm/*", "/var/anaconda3/envs/*", "/tmp/plz_sandbox/test", "/usr/bin/cockpit-bridge",
"/pro/bin/sys/dbutils/dbaValidateOsUserCredentials.sh", "/usr/sbin/lxc", "/sbin/lxc", "/data/flash/Linux_for_Tegra/flash.sh",
"/usr/bin/ansible-playbook", "/usr/local/bin/teleport", "/usr/local/bin/odoo-helper", "/home/*/bin/join-zoom.sh",
"/usr/lib/openssh/sshd-session", "/usr/sbin/lxd", "/usr/sbin/tailscaled"
) or
process.args like~ """import zlib,base64; exec(zlib.decompress(base64.b64decode(b"eJxlU01v2zAMPUe/QvClEqYZTb*""" or
process.working_directory like~ (
"/data/jenkins/.local/share/containers/storage/overlay/*", "/var/run/cloudera-scm-agent/*", "/tmp/pip-req-build*",
"/tmp/pip-resolve-*", "/build/source", "/tmp/pip-install-*", "/opt/airflow", "/tmp/pip-wheel-*", "/tmp/pip-download-*",
"/tmp/plz_sandbox", "/builds/*", "/scratch/*", "/tmp/cmdickens/easybuild/*", "/tmp/thangha/easybuild*",
"/tmp/baum/easybuild/*", "/tmp/zenix-flashing/*", "/opt/ansible*", "/pro/bin/sys/monitor", "/home/jenkins/workspace/*",
"/var/tmp/portage/*", "/tmp/build/*/ansible", "/root/thg-intelligence", "/home/*/*/*/*", "/root/airflow"
) or
process.parent.command_line like~ ("/nix/store/*pytest*", "/bin/bash -c -l source /home/*/.claude/shell-snapshots/snapshot-bash-*") or
process.parent.command_line in ("/bin/bash /docker-entrypoint.sh worker", "/bin/bash /docker-entrypoint.sh") or
(process.parent.args == "/usr/sbin/lxc" and process.parent.args in ("list", "info", "version")) or
(process.working_directory like "/tmp/tmp.*" and process.command_line == "python3 -c import socket; s = socket.socket(); s.bind(('', 0)); print(s.getsockname()[1]); s.close()") or
(
process.executable in ("/bin/python2", "/usr/bin/python2") and
process.command_line like (
"*causixenqueuer/firefoot/config.json*", "*s3loguploader.yml*", "*MUM1_AWS_ACCESS_KEY_ID*", "*/etc/init/ahn.conf*", "*AWS_SECRET_ACCESS_KEY_SGP1*"
)
)
)
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/execution_suspicious_python_shell_execution.toml
-89
View File
@@ -1,89 +0,0 @@
[rule]
description = """
Detects suspicious Python shell executions by monitoring the Python parent process and command line arguments. The
command like arguments contain keywords that are commonly used by attackers to execute malicious code.
"""
id = "d9617a18-cf8b-4bae-b335-598ddabc287c"
license = "Elastic License v2"
name = "Suspicious Python Shell Execution"
os_list = ["linux"]
version = "1.0.13"
query = '''
process where event.type == "start" and event.action == "exec" and process.working_directory != null and
process.parent.executable like~ ("/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*") and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args == "-c" and
process.parent.command_line like~ (
"*exec(*", "*eval(*", "*subprocess*", "*marshal*", "*pickle*", "*pty.*", "*binascii*", "*codecs*",
"*os.system(*", "*os.popen(*", "*pty.spawn(*", "*socket.AF_INET*", "*dup2*", "*fileno()*", "*zlib*",
"*connect(*", "*bind(*", "*execve(*", "*base64*", "*base32*", "*base16*", "*base85*", "*decode(*"
) and not (
process.command_line like~ (
"sh -c /sbin/ldconfig -p 2>/dev/null", "/bin/sh -c mdatp health --field*", "/bin/sh -c uname -p 2> /dev/null",
"/bin/sh -c which hipcc | xargs readlink -f", "*pip install*", "/bin/sh -c ip -o link",
"sh -c -- /bin/su -c echo test", """sh -c -- /bin/su root -c "echo test""""
) or
process.parent.executable like~ (
"/run/containerd/*", "/var/lib/docker/overlay2/*", "/mcp/images/overlay2/*", "/u01/app/oracle.ahf/*", "/opt/SIGOS/generic_decoder/venv/bin/python",
"/bin/sh -c dmidecode --quiet"
) or
process.parent.args like~ (
"""import zlib,base64; exec(zlib.decompress(base64.b64decode(b"eJxlU01v2zAMPUe/QvClEqYZTb*""",
"easybuild.main", "*Thomas Nagy*", "*https://waf.io/book/index.html#_obtaining_the_waf_file*",
"/usr/lib/portage/python*/pid-ns-init", "/usr/lib/python-exec/python*/emerge", "/usr/bin/py3compile"
) or
process.parent.command_line in (
"/usr/local/bin/python -u -c import sys;exec(eval(sys.stdin.readline()))",
"/usr/bin/python3 -u -c import sys;exec(eval(sys.stdin.readline()))"
) or
process.parent.command_line like (
"*pip-setuptools-caller*", "*pip-install*",
"python -c import sys;import base64;sys.stdout.write('@Main\n');exec(base64.b64decode(sys.stdin.readline().rstrip()))#ZeroNetworks"
) or
process.args like "sshpass*" or
process.working_directory like~ (
"/builds/*", "/var/lib/waagent/*", "/workspaces/*", "/build/*", "/opt/airflow", "/opt/bliu/.tmp/pip-install-*",
"/tmp/pip-install-*", "/var/tmp/pip-install-*", "/tmp/pip-build*", "/tmp/pip-wheel-*",
"/usr/local/apps/amd/friday/inl/projects/moose/petsc", "/opt/moose/*", "/tmp/petsc-*/config.setCompilers",
"/tmp/cmdickens/easybuild/*", "/tmp/thangha/easybuild/*", "/tmp/pip-download*",
"/opt/prj/connectxx/cmake-build-flexible-forwarder", "/opt/wBuild/docker/overlay2/*", "/opt/zeek",
"/scratch/*", "/var/tmp/portage/*", "/tmp/baum/easybuild/*"
) or
(process.parent.executable == "/opt/oracle.ahf/python/bin/python3.10" and process.command_line like~ "/bin/sh -c command -v *") or
(
process.parent.name like "python2*" and (
process.parent.args like ("feishu.py", "/home/*/lib/python/pyflow/pyflowTaskWrapper.py") or
process.args like "sudo status*" or
process.command_line == "sh -c uname -p 2> /dev/null"
)
)
)
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/execution_suspicious_ruby_command_execution.toml
+2 -2
View File
@@ -8,7 +8,7 @@ id = "a3a3b49c-c135-4959-8a1b-33392bb60991"
license = "Elastic License v2"
name = "Suspicious Ruby Command Execution"
os_list = ["linux"]
version = "1.0.7"
version = "1.0.8"
query = '''
process where event.type == "start" and event.action == "exec" and process.parent.executable != null and
@@ -20,7 +20,7 @@ process.args like "-e*" and process.command_line like~ (
) and
not (
process.working_directory like~ ("/etc/puppet/rack", "/builds/*", "/var/tmp/portage/*") or
process.command_line like "*rails_env*" or
process.command_line like ("*rails_env*", "*pid*Process.spawn*ssh*StrictHostKeyChecking*ServerAliveInterval*ServerAliveCountMax*") or
process.parent.command_line in ("emacs --daemon", "runc init") or
process.parent.name in ("emacs-gtk", "mmonit", "make") or
(process.name == "ruby" and process.parent.name == "ruby") or
behavior/rules/linux/execution_suspicious_shell_command_execution_via_node.js_parent.toml
+3 -2
View File
@@ -8,7 +8,7 @@ id = "5f6dbe52-6643-486f-9130-256f58ba9a0c"
license = "Elastic License v2"
name = "Suspicious Shell Command Execution via Node.js Parent"
os_list = ["linux"]
version = "1.0.6"
version = "1.0.7"
query = '''
process where event.type == "start" and event.action == "exec" and
@@ -38,9 +38,10 @@ not (
process.command_line like "/bin/sh -c rm -rf /dev/shm/streams/*" and
process.parent.args == "/usr/local/lib/node_modules/pm2/lib/ProcessContainerFork.js"
) or
process.parent.args like ("/home/*/.npm-global/lib/node_modules/openclaw/dist/index.js", "openclaw-gateway") or
process.command_line in (
"""/bin/sh -c echo BROWSER=none > .env && echo DEMO=true >> .env && echo PORT=3000 >> .env && printf "PUBLIC_URL=http://$(hostname -I | awk '{print $1}'):3000/\n" >> .env && echo WDS_SOCKET_PORT=3000 >> .env && printf "WDS_SOCKET_HOST=$(hostname -I | awk '{print $1}')\n" >> .env && echo JSX_IMPORT_SOURCE=@ac/library-utils/dist/web-components/wc-jsx >> .env""",
"/bin/sh -c chmod +x /etc/init.d/pm2-docker-deployer"
"/bin/sh -c chmod +x /etc/init.d/pm2-docker-deployer", """/bin/sh -c grep "^#[ ]*Port[ ]*[0-9]*" /etc/ssh/sshd_config 2>/dev/null"""
) or
(process.command_line like "*shubblecompose-app*" and process.parent.command_line == "node -r dotenv/config dist/server.mjs")
)
behavior/rules/linux/execution_suspicious_shell_execution_via_java_application.toml
+6 -2
View File
@@ -12,7 +12,7 @@ reference = [
"https://www.oracle.com/security-alerts/alert-cve-2025-61882.html",
"https://www.crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882/",
]
version = "1.0.7"
version = "1.0.8"
query = '''
sequence with maxspan=1m
@@ -49,7 +49,11 @@ sequence with maxspan=1m
) or
process.command_line like "*executeXauthorityCommandWithTimeoutIfPossible*" or
process.working_directory like ("/var/opt/oracle/dbaastools_base/pilot*", "/opt/wn/service/agents/esfclient") or
process.parent.executable like "/opt/pycharm*/bin/java" or
process.parent.executable like (
"/opt/pycharm*/bin/java", "/tdst/java/*/bin/java", "/crm/java/*/bin/java", "/*/java/jdk1.8.0_151/bin/java",
"/home/*/BurpSuitePro/jre/bin/java", "/opt/Tanium/TaniumClient/extensions/comply/jre/bin/java",
"/opt/oracle/dcs/java/dcs-agent/*/bin/java"
) or
process.parent.args == "/usr/share/jenkins/agent.jar"
)] by process.parent.entity_id
'''
behavior/rules/linux/execution_unusual_execution_from__dev_parent.toml
+5 -6
View File
@@ -7,15 +7,14 @@ id = "eb575588-dce7-4934-966c-c0e9ebc456c5"
license = "Elastic License v2"
name = "Unusual Execution from /dev Parent"
os_list = ["linux"]
version = "1.0.5"
version = "1.0.6"
query = '''
process where event.type == "start" and event.action == "exec" and process.parent.executable like "/dev/*" and
process.executable like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/var/www/*", "/bin/*", "/usr/bin/*", "/usr/local/bin/*") and
process where event.type == "start" and event.action == "exec" and process.parent.executable like "/dev/*" and
process.executable like ("/tmp/*", "/var/tmp/*", "/var/www/*", "/bin/*", "/usr/bin/*", "/usr/local/bin/*") and
not (
process.parent.executable like (
"/dev/fd/*", "/dev/null/*", "/dev/shm/gitlab/sidekiq/*", "/dev/shm/root/.ansible/tmp/ansible_mitogen_action_*.sh"
) or
process.args like "/dev/shm/*" or
process.parent.executable like ("/dev/fd/*", "/dev/null/*", "/dev/shm/*") or
process.parent.command_line == "runc init" or
process.name in ("buildkitd", "uname") or
process.executable == "/usr/bin/fusermount"
behavior/rules/linux/execution_user_discovery_command_execution_from_shared_memory.toml
-56
View File
@@ -1,56 +0,0 @@
[rule]
description = """
Detects the execution of a user discovery command from a shared memory directory. This is highly abnormal behavior and
can be an indication of malicious activity.
"""
id = "c932c9f0-76ed-4d78-a242-cfaade43080c"
license = "Elastic License v2"
name = "User Discovery Command Execution from Shared Memory"
os_list = ["linux"]
version = "1.0.6"
query = '''
process where event.action == "exec" and event.type == "start" and
process.parent.executable : "/dev/shm/*" and
process.name in ("whoami", "id", "hostname", "ps", "ifconfig", "netstat", "df")
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1033"
name = "System Owner/User Discovery"
reference = "https://attack.mitre.org/techniques/T1033/"
[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/impact_potential_coin_miner_execution.toml
+12 -1
View File
@@ -9,10 +9,21 @@ license = "Elastic License v2"
name = "Potential Coin Miner Execution"
os_list = ["linux"]
reference = ["https://xmrig.com/docs/algorithms"]
version = "1.0.5"
version = "1.0.6"
query = '''
process where event.type == "start" and event.action == "exec" and (
process.name like (
"telnet.netkit", "ping", "telnet", "xmrig", "dash", "bash", "sh", "zsh", "ash", "fish", "ksh", "tcsh",
"csh", "nohup", "pgrep", "python*", "perl*", "ruby*", "php*", "lua*", "sed", "pkill", "docker", "dig",
"nslookup", "inetutils-telnet", "nc.openbsd", "nc", "netcat", "ncat", "curl", "wget", "sudo", "grep", ".*"
) or
process.executable like (
"/tmp/*", "/var/tmp/*", "/dev/shm/*", "/boot/*", "./*", "/sys/*", "/lost+found/*", "/media/*", "/proc/*",
"/var/backups/*", "/var/log/*", "/var/mail/*", "/var/spool/*"
)
) and
(
(
(
(
behavior/rules/linux/impact_potential_coin_miner_execution_via_shell.toml
+8 -4
View File
@@ -9,7 +9,7 @@ license = "Elastic License v2"
name = "Potential Coin Miner Execution via Shell"
os_list = ["linux"]
reference = ["https://xmrig.com/docs/algorithms"]
version = "1.0.9"
version = "1.0.10"
query = '''
process where event.type == "start" and event.action == "exec" and process.parent.executable != null and
@@ -24,11 +24,15 @@ process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
) or process.command_line like ("*stratum+tcp://*", "*stratum2+tcp://*", "*--nicehash*")
) and not (
process.parent.name like (
"find", "python3", "httpd", "sshd", "php*", "sudo", "ruby", "nvim", "vim", "make", "schroot", "vimdiff", "sbuild"
"find", "python3", "httpd", "sshd", "php*", "sudo", "ruby", "nvim", "vim", "make", "schroot", "vimdiff", "sbuild", "ninja"
) or
process.parent.executable in ("/opt/cron/registry-sync/ru/syncRegistryByReport.pl", "/usr/bin/ninja", "/usr/bin/gvimdiff") or
process.parent.executable in (
"/opt/cron/registry-sync/ru/syncRegistryByReport.pl", "/usr/bin/gvimdiff", "/usr/bin/ninja-reference",
"/usr/bin/sw-engine", "/usr/local/bin/teleport"
) or
process.parent.executable like "/tmp/baum/easybuild/*" or
process.command_line like ("*openssl*", "*--display-charset*", "sh -c aws s3 cp*") or
process.parent.args == "/usr/bin/crun"
process.parent.args in ("/usr/bin/crun", "/usr/local/bin/claude")
)
'''
behavior/rules/linux/impact_potential_mining_pool_command_detection.toml
+18 -3
View File
@@ -9,10 +9,21 @@ license = "Elastic License v2"
name = "Potential Mining Pool Command Detection"
os_list = ["linux"]
reference = ["https://falco.org/blog/falco-detect-cryptomining/"]
version = "1.0.6"
version = "1.0.7"
query = '''
process where event.type == "start" and event.action == "exec" and process.command_line like (
process where event.type == "start" and event.action == "exec" and process.parent.executable != null and (
process.name like (
"telnet.netkit", "ping", "telnet", "xmrig", "dash", "bash", "sh", "zsh", "ash", "fish", "ksh", "tcsh",
"csh", "nohup", "pgrep", "python*", "perl*", "ruby*", "php*", "lua*", "sed", "pkill", "docker", "dig",
"nslookup", "inetutils-telnet", "nc.openbsd", "nc", "netcat", "ncat", "curl", "wget", "sudo", "grep", ".*"
) or
process.executable like (
"/tmp/*", "/var/tmp/*", "/dev/shm/*", "/boot/*", "./*", "/sys/*", "/lost+found/*", "/media/*", "/proc/*",
"/var/backups/*", "/var/log/*", "/var/mail/*", "/var/spool/*"
)
) and
process.command_line like (
"*cnpool.cc*", "*lindon-pool.win*", "*supportxmr.com*", "*comgandalph3000.com*", "*minergate.com*",
"*fjhan.club*", "*emercoin.com*", "*poolto.be*", "*520fjh.org*", "*xmrpool.xyz*", "*simka.pw*", "*noobxmr.com*",
"*miner.rocks*", "*minerpool.pw*", "*minemonero.gq*", "*usxmrpool.com*", "*moneroocean.stream*", "*mypool.online*",
@@ -29,7 +40,11 @@ process where event.type == "start" and event.action == "exec" and process.comma
"*c3pool.com*", "*somec.cc*", "*hellominer.com*", "*usa-138.com*", "*mixpools.org*", "*xmrpool.net*",
"*moneroworld.com*", "*minerxmr.ru*", "*d5pool.us*", "*hashcity.org*", "*hex7e4.ru*", "*zpool.ca*", "*minexmr.com*",
"*monerohash.com*", "*multipool.us*", "*moneropool.nl*", "*nbminer.com*", "*ppxxmr.com*", "*xmrfast.com*",
"*webhop.net*", "*ethpool.org*", "*slushpool.com*", "*antpool.com*"
"*webhop.net*", "*ethpool.org*", "*slushpool.com*", "*antpool.com*", "*nicehash.com*", "*nicehash.net*",
"*zergpool.com*", "*mining-dutch.nl*", "*blockmasters.co*", "*bsod.pw*", "*fairpool.xyz*", "*miningrigrentals.com*",
"*hashing24.com*", "*ethermine.org*", "*flexpool.io*", "*hiveon.net*", "*sparkpool.com*", "*2miners.org*",
"*poolin.com*", "*viabtc.com*", "*btc.com*", "*f2pool.org*", "*coinhive.com*", "*cryptoloot.pro*", "*webmine.cz*",
"*minero.cc*", "*monerohash.org*", "*monerohash.net*", "*moneropool.ru*", "*moneroocean.stream*", "*rx.unmineable.com*"
) and not (
process.parent.name in ("sendmail", "postfix-local", "check-quota", "zmcontrol", "find", "timeout", "php") or
process.name in ("timeout", "host", "ptxas") or

Some files were not shown because too many files have changed in this diff Show More