admin/elastic-protections-artifacts
1
0
Fork 0
mirror of https://github.com/elastic/protections-artifacts synced 2026-06-08 14:02:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updating artifacts

Browse Source
This commit is contained in:
protectionsmachine
2026-05-07 10:09:15 +00:00
parent 4e4cb2c449
commit 5d716fbaf5
36 changed files with 2708 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
behavior/rules/cross-platform/discovery_discovery_of_github_actions_runner_process_pid.toml
+93
View File
@@ -0,0 +1,93 @@
[rule]
description = """
This rule detects the discovery of the GitHub Actions Runner process PID using the pgrep command. Adversaries may use
this technique to identify the PID of the GitHub Actions Runner process, which can be used to execute commands on the
runner host. This behavior may indicate malicious or unexpected workflow activity, including code execution, file
manipulation, or network exfiltration initiated through a compromised repository or unauthorized workflow.
"""
id = "d908caa5-2d4c-4ba7-9ce8-5f1ff4315397"
license = "Elastic License v2"
name = "Discovery of GitHub Actions Runner Process PID"
os_list = ["linux", "macos"]
reference = [
"https://socket.dev/blog/trivy-under-attack-again-github-actions-compromise",
"https://www.stepsecurity.io/blog/trivy-compromised-a-second-time---malicious-v0-69-4-release",
"https://www.crowdstrike.com/en-us/blog/from-scanner-to-stealer-inside-the-trivy-action-supply-chain-compromise/",
]
version = "1.0.2"
query = '''
sequence by process.parent.entity_id with maxspan=3s
[process where event.type == "start" and event.action == "exec" and process.name == "pgrep" and
process.args in ("Runner.Listener", "Runner.Worker", "Runner.PluginHost", "run.sh", "svc.sh", "runsvc.sh")] as event0
[process where event.type == "start" and event.action == "exec" and process.name == "pgrep" and
not startswith~(process.command_line, event0.process.command_line) and
process.args in ("Runner.Listener", "Runner.Worker", "Runner.PluginHost", "run.sh", "svc.sh", "runsvc.sh")]
'''
min_endpoint_version = "8.4.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1195"
name = "Supply Chain Compromise"
reference = "https://attack.mitre.org/techniques/T1195/"
[[threat.technique.subtechnique]]
id = "T1195.001"
name = "Compromise Software Dependencies and Development Tools"
reference = "https://attack.mitre.org/techniques/T1195/001/"
[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1057"
name = "Process Discovery"
reference = "https://attack.mitre.org/techniques/T1057/"
[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
[internal]
min_endpoint_version = "8.4.0"
behavior/rules/cross-platform/execution_potential_reverse_shell_activity_via_terminal.toml
+4 -2
View File
@@ -9,7 +9,7 @@ reference = [
"https://github.com/WangYihang/Reverse-Shell-Manager",
"https://www.netsparker.com/blog/web-security/understanding-reverse-shells/",
]
version = "1.0.43"
version = "1.0.44"
query = '''
process where event.action == "exec" and process.name in ("sh", "bash", "zsh", "dash", "zmodload") and
@@ -31,7 +31,9 @@ not (
"/opt/cdf/data/containerd/*", "/usr/bin/consul", "/usr/sbin/sshd", "/usr/bin/runc", "/usr/share/cursor/cursor",
"/home/*/.nvm/versions/node/*/bin/node", "/home/*/t38-k8s/*/k8sts", "/home/*/.opencode/bin/opencode",
"/usr/bin/gnome-shell", "/usr/bin/coreutils", "/home/*/.local/bin/kiro-cli-chat",
"/opt/Tychon/Endpoint/bin/TychonCoreService"
"/opt/Tychon/Endpoint/bin/TychonCoreService", "/usr/local/bin/teleport", "/opt/teleport/system/bin/teleport",
"/usr/bin/claude-bin", "/usr/local/share/npm-global/lib/node_modules/opencode-ai/bin/.opencode",
"/home/*/.local/share/claude/versions/*", "/home/linuxbrew/.linuxbrew/Caskroom/codex/*/codex-x86_64-unknown-linux-musl"
) or
(process.parent.name == "sudo" and process.parent.command_line like "*teleport-installer*") or
(
behavior/rules/cross-platform/execution_suspicious_interpreter_execution_from_stdin.toml
+79
View File
@@ -0,0 +1,79 @@
[rule]
description = """
Identifies interpreters started with - (stdin) where the command line suggests executing code from stdin. This is a
common technique used by attackers to execute code without leaving a trace in the command line.
"""
id = "4aed9b17-873d-48b2-86eb-1af2f695f7fe"
license = "Elastic License v2"
name = "Suspicious Interpreter Execution from Stdin"
os_list = ["linux", "macos"]
reference = [
"https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/",
"https://www.virustotal.com/gui/file/71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238",
]
version = "1.0.3"
query = '''
process where event.type == "start" and event.action == "exec" and
process.executable like (
"/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*",
"/bin/perl*", "/usr/bin/perl*", "/usr/local/bin/perl*",
"/bin/ruby*", "/usr/bin/ruby*", "/usr/local/bin/ruby*",
"/bin/php*", "/usr/bin/php*", "/usr/local/bin/php*",
"/bin/lua*", "/usr/bin/lua*", "/usr/local/bin/lua*"
) and
process.args == "-" and process.args_count <= 2 and
process.parent.executable like (
"/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*",
"/bin/perl*", "/usr/bin/perl*", "/usr/local/bin/perl*",
"/bin/ruby*", "/usr/bin/ruby*", "/usr/local/bin/ruby*",
"/bin/php*", "/usr/bin/php*", "/usr/local/bin/php*",
"/bin/lua*", "/usr/bin/lua*", "/usr/local/bin/lua*"
) and
not process.parent.args in ("/usr/sbin/needrestart", "/sbin/needrestart")
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/collection_multi_value_secret_searching_via_grep.toml
+120
View File
@@ -0,0 +1,120 @@
[rule]
description = """
Identifies the execution of the grep, egrep, fgrep or pgrep commands with a multi-value search pattern to collect
sensitive information. This is a common technique used by attackers to collect sensitive information from the system.
"""
id = "2d00bedd-28aa-4a54-a1e0-92fa00765540"
license = "Elastic License v2"
name = "Multi-Value Secret Searching via Grep"
os_list = ["linux"]
reference = [
"https://socket.dev/blog/10-npm-typosquatted-packages-deploy-credential-harvester",
"https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/",
"https://www.virustotal.com/gui/file/71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238",
]
version = "1.0.3"
query = '''
sequence by process.parent.entity_id with maxspan=10s
[process where event.type == "start" and event.action == "exec" and process.name in ("grep", "egrep", "fgrep", "pgrep") and
process.command_line regex~ """.*\([a-z]{1,15}\|[a-z]{1,15}.*\).*""" and
process.command_line like~ (
"*|pem*", "*pem|*", "*|key*", "*key|*", "*|cred*", "*cred|*", "*|db*", "*db|*", "*|sqlite*", "*sqlite|*", "*|ssh*", "*ssh|*",
"*|conf*", "*conf|*", "*|cnf*", "*cnf|*", "*|ini*", "*ini|*", "*|secret*", "*secret|*", "*|token*", "*token|*",
"*|auth*", "*auth|*", "*|passwd*", "*passwd|*", "*|shadow*", "*shadow|*", "*|env*", "*env|*", "*|database*", "*database|*",
"*|mysql*", "*mysql|*", "*|postgres*", "*postgres|*", "*|mongo*", "*mongo|*", "*|redis*", "*redis|*", "*|vault*", "*vault|*"
)] as event0
[process where event.type == "start" and event.action == "exec" and process.name in ("grep", "egrep", "fgrep", "pgrep") and
not startswith~(process.command_line, event0.process.command_line) and
process.command_line regex~ """.*\([a-z]{1,15}\|[a-z]{1,15}.*\).*""" and
process.command_line like~ (
"*|pem*", "*pem|*", "*|key*", "*key|*", "*|cred*", "*cred|*", "*|db*", "*db|*", "*|sqlite*", "*sqlite|*", "*|ssh*", "*ssh|*",
"*|conf*", "*conf|*", "*|cnf*", "*cnf|*", "*|ini*", "*ini|*", "*|secret*", "*secret|*", "*|token*", "*token|*",
"*|auth*", "*auth|*", "*|passwd*", "*passwd|*", "*|shadow*", "*shadow|*", "*|env*", "*env|*", "*|database*", "*database|*",
"*|mysql*", "*mysql|*", "*|postgres*", "*postgres|*", "*|mongo*", "*mongo|*", "*|redis*", "*redis|*", "*|vault*", "*vault|*"
)] as event1
[process where event.type == "start" and event.action == "exec" and process.name in ("grep", "egrep", "fgrep", "pgrep") and
not startswith~(process.command_line, event1.process.command_line) and
process.command_line regex~ """.*\([a-z]{1,15}\|[a-z]{1,15}.*\).*""" and
process.command_line like~ (
"*|pem*", "*pem|*", "*|key*", "*key|*", "*|cred*", "*cred|*", "*|db*", "*db|*", "*|sqlite*", "*sqlite|*", "*|ssh*", "*ssh|*",
"*|conf*", "*conf|*", "*|cnf*", "*cnf|*", "*|ini*", "*ini|*", "*|secret*", "*secret|*", "*|token*", "*token|*",
"*|auth*", "*auth|*", "*|passwd*", "*passwd|*", "*|shadow*", "*shadow|*", "*|env*", "*env|*", "*|database*", "*database|*",
"*|mysql*", "*mysql|*", "*|postgres*", "*postgres|*", "*|mongo*", "*mongo|*", "*|redis*", "*redis|*", "*|vault*", "*vault|*"
)]
'''
min_endpoint_version = "8.4.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 2
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 2
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1082"
name = "System Information Discovery"
reference = "https://attack.mitre.org/techniques/T1082/"
[[threat.technique]]
id = "T1083"
name = "File and Directory Discovery"
reference = "https://attack.mitre.org/techniques/T1083/"
[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1074"
name = "Data Staged"
reference = "https://attack.mitre.org/techniques/T1074/"
[[threat.technique.subtechnique]]
id = "T1074.001"
name = "Local Data Staging"
reference = "https://attack.mitre.org/techniques/T1074/001/"
[[threat.technique]]
id = "T1119"
name = "Automated Collection"
reference = "https://attack.mitre.org/techniques/T1119/"
[threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"
[internal]
min_endpoint_version = "8.4.0"
behavior/rules/linux/command_and_control_dns_request_by_recently_created_executable.toml
+100
View File
@@ -0,0 +1,100 @@
[rule]
description = """
This rule detects DNS requests initiated by recently created executables in world/user-writable directories. Malware
authors may use these requests to communicate with command and control infrastructure or to exfiltrate data from the
target system.
"""
id = "0c393c67-6eb3-4936-ab44-b807ef8af0f7"
license = "Elastic License v2"
name = "DNS Request by Recently Created Executable"
os_list = ["linux"]
version = "1.0.2"
query = '''
sequence by process.parent.entity_id with maxspan=10s
[file where event.type == "creation" and (
process.name in ("curl", "wget", "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox", "timeout", "env") or
process.name like (".*", "python*", "perl*", "php*", "ruby*", "lua*", "node", "deno") or
process.executable like (
"./*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "/boot/*", "/sys/*",
"/lost+found/*", "/proc/*", "/var/mail/*", "/var/www/*", "/home/*/*", "/root/*"
)
) and
file.path like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/home/*/*", "/root/*", "/var/www/*") and
not (
file.path like (
"/home/*/.claude/downloads/claude-*-linux-x64", "/home/*/.aimee-code/bin/aimee-code"
) or
(
process.executable like "/home/*/go/pkg/mod/golang.org/*/pkg/tool/linux_amd64/link" and
file.path like "/tmp/go-*/exe/vuln-stats"
)
)] as event0
[dns where event.action == "lookup_result" and startswith~(process.executable, event0.file.path) and
dns.question.name != "localhost"]
'''
min_endpoint_version = "9.3.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique.subtechnique]]
id = "T1071.004"
name = "DNS"
reference = "https://attack.mitre.org/techniques/T1071/004/"
[[threat.technique]]
id = "T1102"
name = "Web Service"
reference = "https://attack.mitre.org/techniques/T1102/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "9.3.0"
behavior/rules/linux/command_and_control_dns_request_to_crypto_miner_service.toml
+130
View File
@@ -0,0 +1,130 @@
[rule]
description = """
This rule detects DNS queries to miner services via living-off-the-land executables or executables in
world/user-writable directories. Malware authors may use these services to mine cryptocurrency to generate revenue.
"""
id = "66d449ef-25ee-4fa6-8893-0ced843d1915"
license = "Elastic License v2"
name = "DNS Request to Crypto Miner Service"
os_list = ["linux"]
reference = ["https://xmrig.com/docs/algorithms"]
version = "1.0.1"
query = '''
sequence by process.entity_id with maxspan=1m
[process where event.type == "start" and event.action == "exec" and (
process.name in (
"curl", "wget", "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox",
"timeout", "env", "node", "deno", "nodejs"
) or
process.name like (".*", "python*", "perl*", "php*", "ruby*", "lua*") or
process.executable like (
"./*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "/boot/*", "/sys/*",
"/lost+found/*", "/proc/*", "/var/mail/*", "/var/www/*", "/home/*/*", "/root/*"
) or
process.working_directory like (
"/tmp*", "/var/tmp*", "/dev/shm*", "/run*", "/var/run*", "/boot*", "/sys*", "/lost+found*",
"/proc*", "/var/mail*", "/var/www*", "/home/*/*", "/root/*"
)
)]
[dns where event.action == "lookup_result" and dns.question.name like~ (
"*cnpool.cc", "*lindon-pool.win", "*supportxmr.com", "*comgandalph3000.com", "*minergate.com",
"*fjhan.club", "*emercoin.com", "*poolto.be", "*520fjh.org", "*xmrpool.xyz", "*simka.pw", "*noobxmr.com",
"*miner.rocks", "*minerpool.pw", "*minemonero.gq", "*usxmrpool.com", "*moneroocean.stream", "*mypool.online",
"*xmrpool.de", "*emergate.net", "*ip28.net", "*mine.bz", "*dwarfpool.com", "*xmrig.com", "*koto-pool.work",
"*monerorx.com", "*zarabotaibitok.ru", "*mining-help.ru", "*mine2gether.com", "*moneropool.com", "*viaxmr.com",
"*minerrocks.com", "*miningpoolhub.com", "*cortins.tk", "*pooldd.com", "*unmineable.com", "*f2pool.com",
"*graef.in", "*nanopool.org", "*myxmr.pw", "*ratchetmining.com", "*cryptmonero.com", "*xmrminer.cc",
"*riefly.id", "*iwanttoearn.money", "*herominers.com", "*xmrpool.me", "*miners.pro", "*luckpool.net",
"*twotouchauthentication.online", "*hashvault.pro", "*4i7i.com", "*miningocean.org", "*2miners.com",
"*xmrpool.eu", "*monerpool.org", "*joulecoin.org", "*suprnova.cc", "*bohemianpool.com",
"*crypto-pool.fr", "*xmr.pt", "*alimabi.cn", "*teracycle.net", "*monerogb.com", "*armornetwork.org",
"*emercoin.net", "*poolmining.org", "*minexmr.cn", "*moriaxmr.com", "*ethereumpool.co", "*minercircle.com",
"*prohash.net", "*zer0day.ru", "*crypto-pool.info", "*pool.support", "*siamining.com", "*5b6b7b.ru",
"*c3pool.com", "*somec.cc", "*hellominer.com", "*usa-138.com", "*mixpools.org", "*xmrpool.net",
"*moneroworld.com", "*minerxmr.ru", "*d5pool.us", "*hashcity.org", "*hex7e4.ru", "*zpool.ca", "*minexmr.com",
"*monerohash.com", "*multipool.us", "*moneropool.nl", "*nbminer.com", "*ppxxmr.com", "*xmrfast.com",
"*webhop.net", "*ethpool.org", "*slushpool.com", "*antpool.com", "*nicehash.com", "*nicehash.net",
"*zergpool.com", "*mining-dutch.nl", "*blockmasters.co", "*bsod.pw", "*fairpool.xyz", "*miningrigrentals.com",
"*hashing24.com", "*ethermine.org", "*flexpool.io", "*hiveon.net", "*sparkpool.com", "*2miners.org",
"*poolin.com", "*viabtc.com", "*f2pool.org", "*coinhive.com", "*cryptoloot.pro", "*webmine.cz",
"*minero.cc", "*monerohash.org", "*monerohash.net", "*moneropool.ru", "*moneroocean.stream", "*rx.unmineable.com"
)]
'''
min_endpoint_version = "9.3.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique.subtechnique]]
id = "T1071.004"
name = "DNS"
reference = "https://attack.mitre.org/techniques/T1071/004/"
[[threat.technique]]
id = "T1102"
name = "Web Service"
reference = "https://attack.mitre.org/techniques/T1102/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1496"
name = "Resource Hijacking"
reference = "https://attack.mitre.org/techniques/T1496/"
[threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"
[internal]
min_endpoint_version = "9.3.0"
behavior/rules/linux/command_and_control_dns_request_to_dynamic_dns_via_suspicious_executable.toml
+92
View File
@@ -0,0 +1,92 @@
[rule]
description = """
This rule detects DNS queries to dynamic DNS services via living-off-the-land executables or executables in
world/user-writable directories. Malware authors may use these requests to communicate with command and control
infrastructure or to exfiltrate data from the target system.
"""
id = "b85d016e-3a28-43bd-8fbf-cbb19b09dc46"
license = "Elastic License v2"
name = "DNS Request to Dynamic DNS via Suspicious Executable"
os_list = ["linux"]
reference = ["https://www.rapid7.com/blog/post/tr-new-whitepaper-stealthy-bpfdoor-variants/"]
version = "1.0.3"
query = '''
sequence by process.entity_id with maxspan=10s
[process where event.type == "start" and event.action == "exec" and (
process.name in ("curl", "wget", "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox", "timeout", "env") or
process.name like (".*", "python*", "perl*", "php*", "ruby*", "lua*", "node", "deno") or
process.executable like (
"./*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "/boot/*", "/sys/*",
"/lost+found/*", "/proc/*", "/var/mail/*", "/var/www/*", "/home/*/*", "/root/*"
)
) and not (
(
process.parent.name in ("bash", "node") and
(
process.working_directory in ("/usr/local/meshcentral", "/opt/meshcentral/meshcentral", "/usr/local/mesh_services/meshagent") or
process.parent.args in ("/usr/local/meshcentral/node_modules/meshcentral", "/home/periodic/dyndns-noip.sh")
)
) or
(
process.command_line == "python3 -m app.run_scheduled_update" and
process.parent.args == "./workflow_unified.sh"
)
)]
[dns where event.action == "lookup_result" and dns.question.name like~ (
"*.no-ip.com", "*.no-ip.org", "*.no-ip.biz", "*.no-ip.info", "*.noip.com", "*.afraid.org", "*.changeip.com",
"*.ddns.net", "*.dyndns.org", "*.hopto.org", "*.zapto.org", "*.servehttp.com", "*.sytes.net", "*.myftp.biz",
"*.myftp.org", "*.ddnsfree.com", "*.duckdns.org", "*.000webhostapp.com", "*.myddns.me", "*.dlinkddns.com",
"*.chickenkiller.com", "*.thddns.net", "*.linkpc.net", "*.gotdns.ch", "*.dynv6.net", "*.dns.army",
"*.dns.navy", "*.v6.army", "*.v6.navy", "*.v6.rocks", "*.dyndns-office.com", "*.myvnc.com", "*.is-certified.com",
"*.instanthq.com", "*.ddnsgeek.com", "*.ygto.com", "*.casacam.com"
)]
'''
min_endpoint_version = "9.3.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique.subtechnique]]
id = "T1071.004"
name = "DNS"
reference = "https://attack.mitre.org/techniques/T1071/004/"
[[threat.technique]]
id = "T1102"
name = "Web Service"
reference = "https://attack.mitre.org/techniques/T1102/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "9.3.0"
behavior/rules/linux/command_and_control_dns_request_to_suspicious_file_upload_download_service.toml
+110
View File
@@ -0,0 +1,110 @@
[rule]
description = """
This rule detects DNS queries to suspicious file upload/download services via living-off-the-land executables or
executables in world/user-writable directories. Malware authors may use these services to exfiltrate data from the
target system or to download payloads for later execution.
"""
id = "4b648636-f4d4-4ac8-ac34-df7758201824"
license = "Elastic License v2"
name = "DNS Request to Suspicious File Upload/Download Service"
os_list = ["linux"]
reference = ["https://lolexfil.github.io/"]
version = "1.0.2"
query = '''
sequence by process.entity_id with maxspan=10s
[process where event.type == "start" and event.action == "exec" and (
process.name in ("curl", "wget", "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox", "timeout", "env") or
process.name like (".*", "python*", "perl*", "php*", "ruby*", "lua*", "node", "deno") or
process.executable like (
"./*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "/boot/*", "/sys/*",
"/lost+found/*", "/proc/*", "/var/mail/*", "/var/www/*", "/home/*/*", "/root/*"
)
) and not (
process.executable like "/home/*/OtherApps/firefox/firefox-bin" or
process.working_directory like "/srv/sao/Processing/Workdir/*" or
(
process.parent.executable == "/usr/bin/gnome-shell" and
process.args like (
"/snap/firefox/*/firefox.launcher", "/usr/bin/firefox", "/home/*/OtherApps/firefox/firefox"
)
)
)]
[dns where event.action == "lookup_result" and dns.question.name like~ (
/* Generic suspicious upload/download services */
"*pastebin.com", "*hastebin.com", "*dpaste.org", "*controlc.com", "*0bin.net", "*p.ip.fi", "*sprunge.us",
"*paste.ee", "*paste.ofcode.org", "*textbin.net", "*send.now", "*send.cm", "*pixeldrain.com", "*megaupload.com",
"*mediafire.com", "*bashupload.com", "*bujang.online", "*sendit.sh", "*paste4btc.com", "*ghostbin.com", "*filebin.net",
"*paste.wakas.org",
/* https://lolexfil.github.io/ */
"*anonfiles.com", "*bayfiles.com" , "*bublup.com", "*catbox.moe", "*dropfiles.org", "*dropmefiles.com",
"*easyupload.io", "*file.io", "*filetransfer.io", "*gofile.io", "*qaz.im", "*send.exploit.in", "*sendspace.com",
"*share.riseup.net", "*temp.sh", "*tempsend.com", "*transfer.sh", "*ufile.io", "*paste.rs", "*nopaste.net"
)]
'''
min_endpoint_version = "9.3.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique.subtechnique]]
id = "T1071.004"
name = "DNS"
reference = "https://attack.mitre.org/techniques/T1071/004/"
[[threat.technique]]
id = "T1102"
name = "Web Service"
reference = "https://attack.mitre.org/techniques/T1102/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "9.3.0"
behavior/rules/linux/command_and_control_potential_network_traffic_tunneling_via_proxychains.toml
+47
View File
@@ -0,0 +1,47 @@
[rule]
description = """
This rule identifies the use of proxychains to potentially tunnel network traffic. Attackers can leverage proxychains to
establish hidden communication channels and gain unauthorized access to internal resources, facilitating data
exfiltration or lateral movement via proxychains while evading direct connection blocking.
"""
id = "4484d4b4-499f-4c8e-aa32-be7c0d66eb6c"
license = "Elastic License v2"
name = "Potential Network Traffic Tunneling via Proxychains"
os_list = ["linux"]
reference = [
"https://book.hacktricks.xyz/generic-methodologies-and-resources/tunneling-and-port-forwarding",
"https://github.com/haad/proxychains",
]
version = "1.0.1"
query = '''
process where event.type == "start" and event.action == "exec" and process.name in ("proxychains", "proxychains4", "proxyresolv")
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1572"
name = "Protocol Tunneling"
reference = "https://attack.mitre.org/techniques/T1572/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/defense_evasion_attempt_to_clear_kernel_ring_buffer_via_dmesg.toml
+60
View File
@@ -0,0 +1,60 @@
[rule]
description = """
Monitors for the deletion of the kernel ring buffer events through dmesg. Attackers may clear kernel ring buffer events
to evade detection after installing a Linux kernel module (LKM). This activity is commonly observed by intrusions that
leverage kernel-level rootkits to maintain persistence on a compromised host.
"""
id = "116d477e-8dd3-4de6-bbfd-9c19ca37fb8b"
license = "Elastic License v2"
name = "Attempt to Clear Kernel Ring Buffer via Dmesg"
os_list = ["linux"]
version = "1.0.1"
query = '''
process where event.type == "start" and event.action == "exec" and
process.name == "dmesg" and process.args in ("-c", "--clear") and
not process.parent.executable == "/tmp/newroot/usr/bin/sudo"
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1070"
name = "Indicator Removal"
reference = "https://attack.mitre.org/techniques/T1070/"
[[threat.technique.subtechnique]]
id = "T1070.002"
name = "Clear Linux or Mac System Logs"
reference = "https://attack.mitre.org/techniques/T1070/002/"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/defense_evasion_attempt_to_clear_logs_via_journalctl.toml
+64
View File
@@ -0,0 +1,64 @@
[rule]
description = """
This rule monitors for attempts to clear logs using the "journalctl" command on Linux systems. Adversaries may use this
technique to cover their tracks by deleting or truncating log files, making it harder for defenders to investigate their
activities. The rule looks for the execution of "journalctl" with arguments that indicate log clearing actions, such as
"--vacuum-time", "--vacuum-size", or "--vacuum-files".
"""
id = "2f45b36f-a60d-46c9-9f82-eb80ab62ce7f"
license = "Elastic License v2"
name = "Attempt to Clear Logs via Journalctl"
os_list = ["linux"]
version = "1.0.1"
query = '''
process where event.type == "start" and event.action == "exec" and process.name == "journalctl" and
process.args like~ ("--vacuum-time=?s", "--vacuum-size=?M", "--vacuum-files=*") and
not (
process.parent.args in ("/usr/lib/armbian/armbian-truncate-logs", "/root/innovasive_reverseproxy/backupscript/cleanup_hour.sh") or
process.parent.executable == "/tmp/newroot/usr/bin/sudo"
)
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1070"
name = "Indicator Removal"
reference = "https://attack.mitre.org/techniques/T1070/"
[[threat.technique.subtechnique]]
id = "T1070.002"
name = "Clear Linux or Mac System Logs"
reference = "https://attack.mitre.org/techniques/T1070/002/"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/defense_evasion_attempt_to_disable_auditd_service.toml
+60
View File
@@ -0,0 +1,60 @@
[rule]
description = """
Adversaries may attempt to disable the Auditd service to evade detection. Auditd is a Linux service that provides system
auditing and logging. Disabling the Auditd service can prevent the system from logging important security events, which
can be used to detect malicious activity.
"""
id = "bf76a9f8-42dd-44cc-9e2f-d8693df31d59"
license = "Elastic License v2"
name = "Attempt to Disable Auditd Service"
os_list = ["linux"]
version = "1.0.1"
query = '''
process where event.type == "start" and event.action == "exec" and (
(process.name == "service" and process.args == "stop") or
(process.name == "chkconfig" and process.args == "off") or
(process.name == "update-rc.d" and process.args in ("remove", "disable")) or
(process.name == "systemctl" and process.args in ("disable", "stop", "kill", "mask"))
) and
process.args in ("auditd", "auditd.service") and
not (
process.parent.executable like (
"/var/lib/dpkg/info/auditd.prerm", "/usr/libexec/platform-python*"
) or
(process.name == "systemctl" and process.parent.args == "/usr/lib/systemd/systemd-update-helper") or
process.parent.args like (
"/home/*/.ansible/tmp/ansible-tmp-*/AnsiballZ_*.py", "/var/lib/dpkg/info/auditd.prerm", "/var/tmp/rpm-tmp*"
) or
process.parent.executable == "/opt/kaspersky/kesl/libexec/kesl" or
process.parent.command_line like "*logrotate_script*"
)
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/defense_evasion_attempt_to_disable_selinux.toml
+54
View File
@@ -0,0 +1,54 @@
[rule]
description = """
Adversaries may attempt to disable Security-Enhanced Linux (SELinux), which is a Linux kernel security feature to
support access control policies. Disabling SELinux can allow malicious activities to continue undetected.
"""
id = "54aabfc3-7a78-4241-b0b2-e0de46d8e7b7"
license = "Elastic License v2"
name = "Attempt to Disable SELinux"
os_list = ["linux"]
version = "1.0.1"
query = '''
process where event.type == "start" and event.action == "exec" and
process.name == "setenforce" and process.args == "0" and
not (
process.parent.args like (
"/tmp/ansible-tmp-*/AnsiballZ_command.py", "/tmp/chef-script*", "/root/fapolicyd_rebuild.sh"
) or
process.parent.executable in (
"/opt/Tanium/TaniumClient/Tools/TCMClientUpgrade/ClientManagementUpgrade-upgrade.sh", "/usr/libexec/platform-python",
"/usr/share/centrifydc/libexec/dzdo"
) or
(process.parent.name in ("taskrun", "perl") and process.parent.args == "/usr/local/cpanel/bin/taskrun") or
process.parent.executable like "/usr/libexec/platform-python*"
)
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/defense_evasion_decoded_payload_piped_to_interpreter.toml
+5 -3
View File
@@ -7,7 +7,7 @@ id = "452d6452-a8ec-4cae-9720-567fb44d93b7"
license = "Elastic License v2"
name = "Decoded Payload Piped to Interpreter"
os_list = ["linux"]
version = "1.0.5"
version = "1.0.6"
query = '''
sequence by process.parent.entity_id, process.working_directory with maxspan=1s
@@ -82,9 +82,11 @@ sequence by process.parent.entity_id, process.working_directory with maxspan=1s
process.parent.executable in ("/usr/share/windsurf/windsurf", "/usr/share/cursor/cursor") or
process.parent.command_line like ("claude", "*__CURSOR_SANDBOX_ENV_RESTORE*") or
(
process.args like ("eval*1337*SendConductor*", "eval*KITTY_SSH_KITTEN_DATA_DIR*") and
process.command_line like~ ("*eval*1337*SendConductor*", "*eval*KITTY_SSH_KITTEN_DATA_DIR*") and
process.parent.name == "sshd"
)
) or
process.command_line like "/bin/bash -c base64 -d <<< IwAAACAAAABHAAAAZQAAAHQAAAAgAAAAdAAAAGg*" or
(process.working_directory like "/home/u.*" and process.command_line like "bash -lc printf %s*")
)]
[process where event.type == "start" and event.action == "exec" and process.name like (
"bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish",
behavior/rules/linux/defense_evasion_multiple_system_log_files_deletion.toml
+98
View File
@@ -0,0 +1,98 @@
[rule]
description = """
Monitors for the deletion of multiple sensitive Linux system logs. This may indicate an attempt to evade detection or
destroy forensic evidence on a system.
"""
id = "ffab808c-9944-44eb-8a4b-456a5e6c096d"
license = "Elastic License v2"
name = "Multiple System Log Files Deletion"
os_list = ["linux"]
version = "1.0.1"
query = '''
sequence by process.parent.entity_id with maxspan=10s
[file where event.type == "deletion" and process.executable != null and file.path in (
"/var/run/utmp", "/var/log/wtmp", "/var/log/btmp", "/var/log/lastlog", "/var/log/faillog",
"/var/log/syslog", "/var/log/messages", "/var/log/secure", "/var/log/auth.log", "/var/log/boot.log",
"/var/log/kern.log", "/var/log/dmesg"
) and
not process.executable like (
"/kaniko/executor", "/var/lib/docker/overlay2/*/merged/kaniko/executor", "/kaniko/kaniko-executor"
)] as event0
[file where event.type == "deletion" and process.executable != null and
not startswith~(file.path, event0.file.path) and file.path in (
"/var/run/utmp", "/var/log/wtmp", "/var/log/btmp", "/var/log/lastlog", "/var/log/faillog",
"/var/log/syslog", "/var/log/messages", "/var/log/secure", "/var/log/auth.log", "/var/log/boot.log",
"/var/log/kern.log", "/var/log/dmesg"
) and
not process.executable like (
"/kaniko/executor", "/var/lib/docker/overlay2/*/merged/kaniko/executor", "/kaniko/kaniko-executor"
)] as event1
[file where event.type == "deletion" and process.executable != null and
not startswith~(file.path, event1.file.path) and file.path in (
"/var/run/utmp", "/var/log/wtmp", "/var/log/btmp", "/var/log/lastlog", "/var/log/faillog",
"/var/log/syslog", "/var/log/messages", "/var/log/secure", "/var/log/auth.log", "/var/log/boot.log",
"/var/log/kern.log", "/var/log/dmesg"
) and
not process.executable like (
"/kaniko/executor", "/var/lib/docker/overlay2/*/merged/kaniko/executor", "/kaniko/kaniko-executor"
)]
'''
min_endpoint_version = "8.6.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 2
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 2
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1070"
name = "Indicator Removal"
reference = "https://attack.mitre.org/techniques/T1070/"
[[threat.technique.subtechnique]]
id = "T1070.002"
name = "Clear Linux or Mac System Logs"
reference = "https://attack.mitre.org/techniques/T1070/002/"
[[threat.technique.subtechnique]]
id = "T1070.004"
name = "File Deletion"
reference = "https://attack.mitre.org/techniques/T1070/004/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "8.6.0"
behavior/rules/linux/defense_evasion_potential_disabling_of_apparmor.toml
+59
View File
@@ -0,0 +1,59 @@
[rule]
description = """
Monitors for potential attempts to disable AppArmor. AppArmor is a Linux security module that enforces fine-grained
access control policies to restrict the actions and resources that specific applications and processes can access.
Adversaries may disable AppArmor to avoid possible detection of their tools and activities.
"""
id = "5a19f19d-6f94-475e-9eba-2520685c3861"
license = "Elastic License v2"
name = "Potential Disabling of AppArmor"
os_list = ["linux"]
version = "1.0.1"
query = '''
process where event.type == "start" and event.action == "exec" and (
(process.name == "systemctl" and process.args in ("disable", "stop", "kill", "mask") and process.args in ("apparmor", "apparmor.service")) or
(process.name == "service" and process.args == "apparmor" and process.args == "stop") or
(process.name == "chkconfig" and process.args == "apparmor" and process.args == "off") or
(process.name == "update-rc.d" and process.args == "apparmor" and process.args in ("remove", "disable")) or
(process.name == "ln" and process.args like~ "/etc/apparmor.d/*" and process.args == "/etc/apparmor.d/disable/")
) and
not (
process.parent.executable in ("/opt/puppetlabs/puppet/bin/ruby", "/lib/systemd/systemd-sysv-install") or
process.parent.args like "/var/lib/dpkg/info/*.postinst" or
process.working_directory == "/home/ansible"
)
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/defense_evasion_shared_object_injection_via_process_environment_variable.toml
+3 -2
View File
@@ -9,7 +9,7 @@ license = "Elastic License v2"
name = "Shared Object Injection via Process Environment Variable"
os_list = ["linux"]
reference = ["https://attack.mitre.org/techniques/T1574/006/"]
version = "1.0.47"
version = "1.0.48"
query = '''
process where event.type == "start" and event.action == "exec" and process.env_vars like "LD_PRELOAD=?*" and
@@ -58,7 +58,8 @@ process where event.type == "start" and event.action == "exec" and process.env_v
"LD_PRELOAD=/lib/x86_64-linux-gnu/libSegFault.so", "LD_PRELOAD=/usr/lib/libnss_wrapper.so",
"LD_PRELOAD=/tmp/*/openwrt-imagebuilder*/runas.so", "LD_PRELOAD=/tmp/pressure-vessel-libs-*/libMangoHud_shim.so",
"LD_PRELOAD=/home/libjemalloc.so.2", "LD_PRELOAD=/tmp/libredirectnull.so", "LD_PRELOAD=/tmp/libcuda_trace.so",
"LD_PRELOAD=:/usr/lib/libjemalloc.so", "LD_PRELOAD=/lib/libSegFault.so"
"LD_PRELOAD=:/usr/lib/libjemalloc.so", "LD_PRELOAD=/lib/libSegFault.so", "LD_PRELOAD=/tmp/baum/easybuild/*",
"LD_PRELOAD=/home/*/.local/share/WebexLauncher/*/bin/../lib/libCefMallinfoShim.so"
) or
(process.env_vars == "LD_PRELOAD=./getrandom.so" and process.parent.command_line == "/opt/perlbrew/perls/perl-5.40.3/bin/perl t/getrandom.t") or
process.parent.command_line == "runc init" or
behavior/rules/linux/defense_evasion_suspicious_binary_execution_via_path_alias.toml
+58
View File
@@ -0,0 +1,58 @@
[rule]
description = """
Detects execution of binaries through the /proc/self/root procfs path alias. This technique resolves to the filesystem
root through procfs and can bypass path-based denylists or security controls that match on canonical paths like
/usr/bin/. An AI coding agent (Claude Code) was observed using this technique autonomously to evade its own permission
denylist without any adversarial prompting. This is also a general defense evasion technique usable by any process.
"""
id = "5b95dcac-7e0a-4f3c-ab4b-a94cf84d793e"
license = "Elastic License v2"
name = "Suspicious Binary Execution via Path Alias"
os_list = ["linux"]
reference = [
"https://awesomeagents.ai/news/claude-code-sandbox-escape-denylist/",
"https://man7.org/linux/man-pages/man5/proc.5.html",
]
version = "1.0.3"
query = '''
process where event.type == "start" and event.action == "exec" and
(
process.executable like "/proc/*/root/*" or
process.args regex """/proc/(self|[0-9]{1,7})/root/[a-z].*"""
) and
not process.args like ("/proc/*/root/etc/*", "/proc/1/root/var/lib/rancher/*", "/proc/1/root/var/lib/cni/*", "cat", "readlink", "ls")
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"
[[threat.technique.subtechnique]]
id = "T1036.005"
name = "Match Legitimate Name or Location"
reference = "https://attack.mitre.org/techniques/T1036/005/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/execution_bpf_filter_applied_using_traffic_control.toml
+68
View File
@@ -0,0 +1,68 @@
[rule]
description = """
Detects when the tc (traffic control) binary is utilized to set a BPF (Berkeley Packet Filter) on a network interface.
Tc is used to configure Traffic Control in the Linux kernel. It can shape, schedule, police and drop traffic. A threat
actor can utilize tc to set a bpf filter on an interface for the purpose of manipulating the incoming traffic. This
technique is not at all common and should indicate abnormal, suspicious or malicious activity.
"""
id = "bde36476-0c2c-40df-b3b1-941b0b31e444"
license = "Elastic License v2"
name = "BPF Filter Applied using Traffic Control"
os_list = ["linux"]
version = "1.0.1"
query = '''
process where event.type == "start" and event.action == "exec" and process.name == "tc" and
process.args == "filter" and process.args == "add" and process.args == "bpf" and
not process.parent.executable == "/usr/sbin/libvirtd"
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/execution_non_interactive_shell_upgrade.toml
+68
View File
@@ -0,0 +1,68 @@
[rule]
description = """
Identifies when a non-interactive terminal (tty) is being upgraded to a fully interactive shell. Attackers may upgrade a
simple reverse shell to a fully interactive tty after obtaining initial access to a host, in order to obtain a more
stable connection.
"""
id = "f1e932e5-41c5-465f-823b-83fc6f379bb4"
license = "Elastic License v2"
name = "Non-interactive Shell Upgrade"
os_list = ["linux"]
version = "1.0.1"
query = '''
process where event.type == "start" and event.action == "exec" and (
(
process.name == "stty" and
process.args == "raw" and
process.args == "-echo" and
process.args_count >= 3
) or
(
process.name == "script" and
process.args in ("-qc", "-c") and
process.args == "/dev/null" and
process.args_count == 4
)
) and
not (
process.parent.command_line like ("linode-longview", "*bootstrap*", "*homebrew*", "*/home/*/.claude/shell-snapshots/snapshot*") or
process.parent.executable in ("/usr/bin/expect", "/usr/bin/nsh-single-command", "/usr/bin/runc") or
process.command_line == "stty -echo raw min 0 time 2" or
process.args like ("/dev/tty*", "/dev/serial/*") or
process.parent.args == "/usr/share/emacs/site-lisp/emacspeak/servers/dtk-exp"
)
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/execution_potential_reverse_shell_activity_via_tcp_udp_socket.toml
+5 -4
View File
@@ -12,7 +12,7 @@ reference = [
"https://github.com/WangYihang/Reverse-Shell-Manager",
"https://www.netsparker.com/blog/web-security/understanding-reverse-shells/",
]
version = "1.0.4"
version = "1.0.5"
query = '''
process where event.type == "start" and event.action == "exec" and process.parent.executable != null and (
@@ -29,14 +29,15 @@ process where event.type == "start" and event.action == "exec" and process.paren
process.command_line like ("*/dev/tcp/*", "*/dev/udp/*", "*zsh/net/tcp*", "*zsh/net/udp*") and
process.command_line like ("*&>*", "*<>*", "*>&*", "*<&*") and
not (
process.command_line like ("*/dev/tcp/127.0.0.1/*", "*/dev/tcp/localhost/*") or
process.parent.command_line == "/usr/bin/runc init" or
process.command_line like ("*/dev/tcp/127.0.0.1/*", "*/dev/tcp/localhost/*", "*/home/*/.claude/shell-snapshots/snapshot*") or
process.parent.command_line like ("/usr/bin/runc init", "*/home/*/.claude/shell-snapshots/snapshot*") or
process.parent.args in ("/usr/bin/testssl.sh", "/usr/local/bin/testssl.sh", "/usr/bin/crun") or
process.parent.executable like (
"/usr/share/windsurf/resources/app/extensions/windsurf/bin/language_server_linux_x64", "/home/*/.cursor-server/bin/*/node", "/root/.cursor-server/cli/servers/*/server/node",
"/usr/local/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/codex/codex", "/opt/teleport/system/bin/teleport",
"/home/*/.local/bin/claude", "/usr/bin/claude-bin", "/home/*/.config/Claude/claude-code-vm/*/claude", "/usr/share/cursor/cursor", "/usr/local/bin/teleport",
"/home/*/.local/share/claude/versions/*"
"/home/*/.local/share/claude/versions/*", "/home/*/.local/bin/kiro-cli-chat", "./runc", "/home/linuxbrew/.linuxbrew/Caskroom/codex/*/codex-x86_64-unknown-linux-musl",
"/home/*/.opencode/bin/opencode"
)
)
'''
behavior/rules/linux/execution_suspicious_interactive_terminal_spawn.toml
+77
View File
@@ -0,0 +1,77 @@
[rule]
description = """
Identifies when an interactive terminal is spawned via an interpreter parent process. This behavior indicates an
attacker is attempting to gain a more stable connection to a host after obtaining initial access.
"""
id = "442f824f-a2bb-4052-83d0-4c9514d31214"
license = "Elastic License v2"
name = "Suspicious Interactive Terminal Spawn"
os_list = ["linux"]
version = "1.0.1"
query = '''
process where event.type == "start" and event.action == "exec" and (
(
process.name == "perl" and process.args like "-e*" and process.command_line like "*exec*" and
process.command_line like ("*\"*sh\";*", "*'*sh';*")
) or
(
process.parent.name like "python*" and
process.name in ("bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "mksh", "busybox") and
(
(
process.parent.args_count >= 3 and
process.parent.args like~ "*pty.spawn*" and
process.parent.args == "-c"
) or
(
process.args in (
"bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "mksh", "busybox",
"/bin/bash", "/bin/dash", "/bin/ash", "/bin/sh", "/bin/tcsh", "/bin/csh",
"/bin/zsh", "/bin/ksh", "/bin/fish", "/bin/mksh", "/bin/busybox",
"/usr/bin/bash", "/usr/bin/dash", "/usr/bin/ash", "/usr/bin/sh", "/usr/bin/tcsh", "/usr/bin/csh",
"/usr/bin/zsh", "/usr/bin/ksh", "/usr/bin/fish", "/usr/bin/mksh", "/usr/bin/busybox",
"/usr/local/bin/bash", "/usr/local/bin/dash", "/usr/local/bin/ash", "/usr/local/bin/sh",
"/usr/local/bin/tcsh", "/usr/local/bin/csh", "/usr/local/bin/zsh", "/usr/local/bin/ksh",
"/usr/local/bin/fish", "/usr/local/bin/mksh", "/usr/local/bin/busybox"
) and
process.args_count == 1 and
process.parent.args_count == 1
)
)
)
)
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/initial_access_potential_remote_code_execution_via_database_server.toml
+272
View File
@@ -0,0 +1,272 @@
[rule]
description = """
This rule detects potential remote code execution attempts via commonly used database server applications, by monitoring
for unusual child processes and command line arguments.
"""
id = "057bd963-2dce-4951-87ce-5923803158ff"
license = "Elastic License v2"
name = "Potential Remote Code Execution via Database Server"
os_list = ["linux"]
version = "1.0.7"
query = '''
process where event.type == "start" and event.action == "exec" and process.parent.interactive == false and (
process.parent.name in (
"redis-server", "mongod", "mysqld", "oracle", "tnslsnr", "postgres", "mariadbd", "sqlservr",
"beam.smp", "db2sysc", "clickhouse-server"
) or
(process.parent.name == "redis-check-rdb" and process.parent.command_line like "*redis-server*")
) and
not (
(process.parent.name == "oracle" and process.args like "/bin/grep -q kubepods /proc/self/cgroup*") or
(process.parent.name == "beam.smp" and process.name == "erl_child_setup") or
(process.parent.name == "erl_child_setup" and process.command_line like ("*rabbitmq-env.conf*echo*VARS*set", "inet_gethost 4")) or
(process.name == "epmd" and process.command_line == "epmd -daemon")
) and
(
process.name in (
"scp", "gzip", "bzip2", "xz", "tar", "getcap", "capsh", "find", "nohup", "setsid", "timeout", "disown",
"mkfifo", "printenv", "env", "chpasswd", "touch", "echo"
) or
process.name like ".*" or
(
process.name in ("whoami", "id", "hostname", "uname", "ps", "netstat", "ss", "ip", "ifconfig") and
process.interactive == true and process.parent.interactive == false
) or
process.executable like ("/dev/shm/*", "/tmp/*", "/var/tmp/*", "/root/*", "./*") or
(
process.executable like ("/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*") and (
process.args == "-c" or
(
process.args_count <= 2 and
process.args like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/var/www/*", "/root/*", "/home/*/*", "./*.py") and
process.args like "*.py*"
)
) and
not process.args in ("--version", "app.py")
) or
(
process.executable like (
"/bin/perl*", "/usr/bin/perl*", "/usr/local/bin/perl*",
"/bin/ruby*", "/usr/bin/ruby*", "/usr/local/bin/ruby*",
"/bin/lua*", "/usr/bin/lua*", "/usr/local/bin/lua*",
"/bin/node", "/usr/bin/node", "/usr/local/bin/node"
) and
(process.args like "-e*" or process.args_count <= 2)
) or
(
process.executable like ("/bin/php*", "/usr/bin/php*", "/usr/local/bin/php*") and
(process.args like "-r*" or process.args_count <= 2) and
not (
process.args like "var_export*" or
process.command_line in ("php -r echo get_current_user().PHP_EOL;", "php -r echo date('T');")
)
) or
(
process.name in ("netcat", "nc", "ncat", "nc.traditional", "nc.openbsd") and (
process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*" or
process.command_line like "*http*"
) and
not process.args in ("localhost", "127.0.0.1", "-z", "-zv")
) or
(
process.name == "socat" and
process.command_line like~ ("*exec*", "*tty*", "*fork*", "*file*", "*open*") and
process.command_line like~ ("*tcp*", "*udp*", "*openssl*")
) or
(
process.name == "openssl" and (
process.command_line like ("*s_server*", "*s_client*") or
(process.args == "enc" and process.args in ("-d", "-base64", "-a", "-A"))
)
) or
(
process.name in ("curl", "wget") and process.args like~ ("-o", "--output*", "-o-") and (
process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*" or
process.command_line like "*http*"
) and
process.command_line like ("* /tmp/*", "* /var/tmp/*", "* /dev/shm/*", "* /var/www/*", "* ~/*", "* /home/*", "* /run/*", "* /var/run/*")
) or
(
process.name in ("base64", "basez", "base64plain", "base64url", "base64mime", "base64pem", "basenc", "base32", "base16") and
process.args like~ "-*d*"
) or
(
process.name == "xxd" and process.args like~ ("-*r*", "-*p*")
) or
(process.name == "sudo" and process.args == "-l") or
(
process.executable like ("/bin/chmod", "/usr/bin/chmod", "/usr/local/bin/chmod") and
process.args like ("+x", "a+x", "0777", "755", "777", "+s", "u+s", "g+s")
) or
(
process.executable like ("/bin/cat", "/usr/bin/cat", "/usr/local/bin/cat") and
process.args like (
"/etc/passwd", "/etc/shadow", "/etc/hostname", "/etc/hosts", "*ssh*", "/proc/self/environ",
"*.env*", "*../../../*", "*/secrets/kubernetes.io/serviceaccount/*", "*/.docker/config.json*",
"*/.npmrc*", "*.aws/credentials*", "*/.aws/config*"
)
) or
(
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox") and
process.args in ("-c", "-cl", "-lc") and (
process.command_line like (
/* Suspicious Paths */
"* /tmp/* ", "* /var/tmp/* ", "* /dev/shm/*", "* /var/www/*", "* /run/*", "* /var/run/*",
/* Interpreter Execution */
"*python* -c*", "*php* -r*", "*perl* -e*", "*ruby* -e*", "*lua* -e*", "*node * -e *",
/* Encoding, Decoding & Piping */
"*|sh", "*| sh *", "*| sh ", "*|bash*", "*| bash*", "*|zsh*", "*| zsh*", "*|dash*", "*| dash*",
"*|python*", "*| python*", "*|php*", "*| php*", "*|perl*", "*| perl*", "*|ruby*", "*| ruby*",
"*|node*", "*| node*", "*|lua*", "*| lua*", "*|busybox*", "*| busybox*", "*|*base64 -d*", "*|*base64 --decode*",
"*|*base64 --decode*", "*|*openssl base64 -d*", "*xxd *", "*| openssl*enc * -d *", "*b64decode -r*",
/* Reverse Shells */
"*netcat *", "* nc *", "*ncat *", "*/dev/tcp*", "*/dev/udp/*", "*socat *", "*openssl*s_client *", "*stty*raw*-echo*",
/* File Access */
"*>*/etc/cron*", "*/etc/ssh*", "*/home/*/.ssh/*", "*/root/.ssh*", "*~/.ssh/*", "*/etc/shadow*", "*/etc/passwd*", "*chpasswd*",
/* Helpers */
"*nohup*", "*setsid *", "*timeout *sh -c *", "*disown*", "*env *sh *-c*",
/* Miscellaneous */
"*chattr *", "*busybox *", "*#!*", "*chmod +x *", "*chmod 777*",
/* Decompression */
"*gzip -*d *", "*bzip2 -*d *", "*xz -*d *", "*tar -*x*",
/* Path Traversal */
"*../../../*etc/*", "*/.../*", "*../../../*home/*/*", "*../../../*root/*"
) or
(
process.command_line like ("*wget *", "*curl *") and
(
process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}(:[0-9]{1,5})?/.*" or
process.command_line like ("*http*", "*ftp*")
) and
(
(
process.command_line regex~ """.*curl.* \-[a-zA-Z]*[oO]( .+|\-.*)?""" or
process.command_line like~ ("*curl* --output*", "*curl* --remote-name*")
) or
(
(
process.command_line regex~ """.*wget.* \-[a-zA-Z]*O.*""" or
process.command_line like~ "*wget* --output-document*"
) and
not process.command_line like """*--output-document "-"*"""
) or
process.command_line like ("*|*sh*", "*|*python*", "*|*php*", "*|*perl*", "*|*ruby*", "*|*node*", "*|*lua*", "*|*busybox*") or
(
process.command_line like ("*curl *>> /*", "*curl *>>/*", "*curl *> /*", "*curl *>/*", "*wget *>> /*", "*wget *>>/*", "*wget *> /*", "*wget *>/*") and
not process.command_line like ("*> /dev/null*", "*>/dev/null*", "*curl*/etc/cobra/*/uploads/whatsapp/*")
)
) and
not process.command_line like ("*-O /dev/null*", "*-o /dev/null*")
)
)
)
) and
not (
process.executable like ("/tmp/newroot/*", "./runc") or
process.command_line == "sh -c locale -a" or
process.args == "/usr/bin/env" and process.args in ("check_postgres.pl", "/usr/lib/pscheduler/commands/validate-configurables") or
(
process.parent.executable == "/etc/init.d/redis-server" and
process.command_line in ("chmod 755 /var/run/redis", "touch /var/run/redis/redis-server.pid")
) or
(
process.parent.name == "postgres" and
process.command_line in ("ps -p 1", "python2 -c pass")
)
)
'''
min_endpoint_version = "8.3.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1190"
name = "Exploit Public-Facing Application"
reference = "https://attack.mitre.org/techniques/T1190/"
[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1505"
name = "Server Software Component"
reference = "https://attack.mitre.org/techniques/T1505/"
[[threat.technique.subtechnique]]
id = "T1505.001"
name = "SQL Stored Procedures"
reference = "https://attack.mitre.org/techniques/T1505/001/"
[[threat.technique]]
id = "T1554"
name = "Compromise Host Software Binary"
reference = "https://attack.mitre.org/techniques/T1554/"
[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1210"
name = "Exploitation of Remote Services"
reference = "https://attack.mitre.org/techniques/T1210/"
[threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "8.3.0"
behavior/rules/linux/initial_access_potential_remote_code_execution_via_mail_server.toml
+272
View File
@@ -0,0 +1,272 @@
[rule]
description = """
This rule detects potential remote code execution attempts via commonly used mail server applications, by monitoring for
unusual child processes and command line arguments.
"""
id = "318e6a4f-fb72-4010-a625-d41bae9e349a"
license = "Elastic License v2"
name = "Potential Remote Code Execution via Mail Server"
os_list = ["linux"]
version = "1.0.4"
query = '''
process where event.type == "start" and event.action == "exec" and process.parent.interactive == false and
(
process.parent.name in ("exim4", "postfix", "smtpd", "sendmail", "dovecot", "amavisd-new", "amavisd", "spamd") or
(
process.parent.name == "master" and
process.parent.executable like "/*/postfix*master"
)
) and
not (
(process.parent.name == "exim4" and process.args like "/usr/lib/nagios/plugins/check_file_age*") or
(process.parent.name in ("amavisd-new", "amavisd") and process.command_line == "/usr/bin/gzip -d") or
(process.parent.name == "dovecot" and process.command_line == "gzip") or
(process.parent.name == "amavisd" and process.name == "amavisd")
) and
(
process.name in (
"scp", "gzip", "bzip2", "xz", "tar", "getcap", "capsh", "find", "nohup", "setsid", "timeout", "disown",
"mkfifo", "printenv", "env", "chpasswd", "echo"
) or
(
process.name == "touch" and
not process.args like (
"/home/*/.esmtp_queue/*/lock", "/root/.esmtp_queue/*/lock", "/prod/prod/data/prodstage/possum/error/"
)
) or
process.name like ".*" or
(
process.name in ("whoami", "id", "hostname", "uname", "ps", "netstat", "ss", "ip", "ifconfig") and
process.interactive == true and process.parent.interactive == false
) or
process.executable like ("/dev/shm/*", "/tmp/*", "/var/tmp/*", "/root/*", "./*") or
(
process.executable like ("/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*") and (
process.args == "-c" or
(
process.args_count <= 2 and
process.args like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/var/www/*", "/root/*", "/home/*/*", "./*.py") and
process.args like "*.py*"
)
) and
not process.args in ("--version", "app.py")
) or
(
process.executable like (
"/bin/perl*", "/usr/bin/perl*", "/usr/local/bin/perl*",
"/bin/ruby*", "/usr/bin/ruby*", "/usr/local/bin/ruby*",
"/bin/lua*", "/usr/bin/lua*", "/usr/local/bin/lua*",
"/bin/node", "/usr/bin/node", "/usr/local/bin/node"
) and
(process.args like "-e*" or process.args_count <= 2)
) or
(
process.executable like ("/bin/php*", "/usr/bin/php*", "/usr/local/bin/php*") and
(process.args like "-r*" or process.args_count <= 2) and
not (
process.args like "var_export*" or
process.command_line in ("php -r echo get_current_user().PHP_EOL;", "php -r echo date('T');")
)
) or
(
process.name in ("netcat", "nc", "ncat", "nc.traditional", "nc.openbsd") and (
process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*" or
process.command_line like "*http*"
) and
not process.args in ("localhost", "127.0.0.1", "-z", "-zv")
) or
(
process.name == "socat" and
process.command_line like~ ("*exec*", "*tty*", "*fork*", "*file*", "*open*") and
process.command_line like~ ("*tcp*", "*udp*", "*openssl*")
) or
(
process.name == "openssl" and (
process.command_line like ("*s_server*", "*s_client*") or
(process.args == "enc" and process.args in ("-d", "-base64", "-a", "-A"))
)
) or
(
process.name in ("curl", "wget") and process.args like~ ("-o", "--output*", "-o-") and (
process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*" or
process.command_line like "*http*"
) and
process.command_line like ("* /tmp/*", "* /var/tmp/*", "* /dev/shm/*", "* /var/www/*", "* ~/*", "* /home/*", "* /run/*", "* /var/run/*")
) or
(
process.name in ("base64", "basez", "base64plain", "base64url", "base64mime", "base64pem", "basenc", "base32", "base16") and
process.args like~ "-*d*"
) or
(
process.name == "xxd" and process.args like~ ("-*r*", "-*p*")
) or
(process.name == "sudo" and process.args == "-l") or
(
process.executable like ("/bin/chmod", "/usr/bin/chmod", "/usr/local/bin/chmod") and
process.args like ("+x", "a+x", "0777", "755", "777", "+s", "u+s", "g+s")
) or
(
process.executable like ("/bin/cat", "/usr/bin/cat", "/usr/local/bin/cat") and
process.args like (
"/etc/passwd", "/etc/shadow", "/etc/hostname", "/etc/hosts", "*ssh*", "/proc/self/environ",
"*.env*", "*../../../*", "*/secrets/kubernetes.io/serviceaccount/*", "*/.docker/config.json*",
"*/.npmrc*", "*.aws/credentials*", "*/.aws/config*"
)
) or
(
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox") and
process.args in ("-c", "-cl", "-lc") and (
process.command_line like (
/* Suspicious Paths */
"* /tmp/* ", "* /var/tmp/* ", "* /dev/shm/*", "* /var/www/*", "* /run/*", "* /var/run/*",
/* Interpreter Execution */
"*python* -c*", "*php* -r*", "*perl* -e*", "*ruby* -e*", "*lua* -e*", "*node * -e *",
/* Encoding, Decoding & Piping */
"*|sh", "*| sh *", "*| sh ", "*|bash*", "*| bash*", "*|zsh*", "*| zsh*", "*|dash*", "*| dash*",
"*|python*", "*| python*", "*|php*", "*| php*", "*|perl*", "*| perl*", "*|ruby*", "*| ruby*",
"*|node*", "*| node*", "*|lua*", "*| lua*", "*|busybox*", "*| busybox*", "*|*base64 -d*", "*|*base64 --decode*",
"*|*base64 --decode*", "*|*openssl base64 -d*", "*xxd *", "*| openssl*enc * -d *", "*b64decode -r*",
/* Reverse Shells */
"*netcat *", "* nc *", "*ncat *", "*/dev/tcp*", "*/dev/udp/*", "*socat *", "*openssl*s_client *", "*stty*raw*-echo*",
/* File Access */
"*>*/etc/cron*", "*/etc/ssh*", "*/home/*/.ssh/*", "*/root/.ssh*", "*~/.ssh/*", "*/etc/shadow*", "*/etc/passwd*", "*chpasswd*",
/* Helpers */
"*nohup*", "*setsid *", "*timeout *sh -c *", "*disown*", "*env *sh *-c*",
/* Miscellaneous */
"*chattr *", "*busybox *", "*#!*", "*chmod +x *", "*chmod 777*",
/* Decompression */
"*gzip -*d *", "*bzip2 -*d *", "*xz -*d *", "*tar -*x*",
/* Path Traversal */
"*../../../*etc/*", "*/.../*", "*../../../*home/*/*", "*../../../*root/*"
) or
(
process.command_line like ("*wget *", "*curl *") and
(
process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}(:[0-9]{1,5})?/.*" or
process.command_line like ("*http*", "*ftp*")
) and
(
(
process.command_line regex~ """.*curl.* \-[a-zA-Z]*[oO]( .+|\-.*)?""" or
process.command_line like~ ("*curl* --output*", "*curl* --remote-name*")
) or
(
(
process.command_line regex~ """.*wget.* \-[a-zA-Z]*O.*""" or
process.command_line like~ "*wget* --output-document*"
) and
not process.command_line like """*--output-document "-"*"""
) or
process.command_line like ("*|*sh*", "*|*python*", "*|*php*", "*|*perl*", "*|*ruby*", "*|*node*", "*|*lua*", "*|*busybox*") or
(
process.command_line like ("*curl *>> /*", "*curl *>>/*", "*curl *> /*", "*curl *>/*", "*wget *>> /*", "*wget *>>/*", "*wget *> /*", "*wget *>/*") and
not process.command_line like ("*> /dev/null*", "*>/dev/null*", "*curl*/etc/cobra/*/uploads/whatsapp/*")
)
) and
not process.command_line like ("*-O /dev/null*", "*-o /dev/null*")
)
)
)
) and
not (
process.executable like ("/tmp/newroot/*", "/opt/lxc/*", "/var/snap/lxd/*") or
process.parent.command_line == "runc init" or
process.command_line in ("pickup -l -t unix -u", "pickup -l -t unix -u -c") or
(
process.parent.executable == "/etc/init.d/postfix" and process.command_line == "/bin/echo -n postfix is running"
) or
(
process.parent.executable == "/usr/libexec/postfix/master" and
process.command_line in ("/usr/bin/hostname", "ps -eo pid,args", "uname -m")
) or
(
process.parent.executable == "/usr/sbin/dovecot" and
process.command_line like "*/usr/local/cpanel/3rdparty/wp-toolkit/plib/vendor/wp-cli/wpt-wp-cli.php*"
)
)
'''
min_endpoint_version = "8.3.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1190"
name = "Exploit Public-Facing Application"
reference = "https://attack.mitre.org/techniques/T1190/"
[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1554"
name = "Compromise Host Software Binary"
reference = "https://attack.mitre.org/techniques/T1554/"
[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1210"
name = "Exploitation of Remote Services"
reference = "https://attack.mitre.org/techniques/T1210/"
[threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "8.3.0"
behavior/rules/linux/persistence_payload_downloaded_via_curl_or_wget_by_web_server.toml
+215
View File
@@ -0,0 +1,215 @@
[rule]
description = """
This rule detects when a web server downloads a payload via curl or wget. Attackers may exploit RCE or file upload
vulnerabilities to download malicious files to web servers to gain/maintain access and to establish a command and
control channel.
"""
id = "aac41cc3-fc4a-4dea-b8d6-252ded1cb3fc"
license = "Elastic License v2"
name = "Payload Downloaded via Curl or Wget by Web Server"
os_list = ["linux"]
version = "1.0.6"
query = '''
process where event.type == "start" and event.action == "exec" and process.parent.interactive == false and (
process.parent.name in (
"nginx", "apache2", "httpd", "caddy", "mongrel_rails", "uwsgi", "daphne", "httpd.worker", "flask",
"php-cgi", "php-fcgi", "php-cgi.cagefs", "lswsctrl", "varnishd", "uvicorn", "waitress-serve", "starman",
"frankenphp", "zabbix_server", "asterisk", "sw-engine-fpm"
) or
process.parent.name like ("php-fpm*", "gunicorn*", "*.cgi", "*.fcgi") or
(
process.parent.name like "ruby*" and
process.parent.command_line like~ ("*puma*", "*rails*", "*passenger*") and
not process.command_line like "*github.com/phusion/passenger/releases/download/release*"
) or
(process.parent.name like "python*" and process.parent.command_line like~ (
"*hypercorn*", "*flask*", "*uvicorn*", "*django*", "*app.py*", "*server.py*", "*wsgi.py*", "*asgi.py*"
)) or
(process.parent.name like "perl*" and process.parent.command_line like~ "*plackup*") or
(process.parent.name == "node" and process.parent.command_line like~ (
"*next start*", "*--port*", "*PORT=*", "*HOST=*", "*0.0.0.0*", "*/dist/*.js*", "*/build/*.js*", "*/server/*.js*",
"*/app/*.js*", "*/apps/*/*.js*", "*/index.js*", "*/main.js*", "*/srv/*", "*/opt/*", "*/var/www/*", "*n8n*"
) and
not process.parent.args like (
"/opt/cursor-agent/*", "/home/*/*", "/root/*", "/opt/vscode-server/*", "/usr/lib/node_modules/openclaw/dist/index.js",
"/home/*/.npm-global/lib/node_modules/openclaw/dist/index.js", "openclaw-gateway"
)
) or
(process.parent.name == "java" and process.parent.args like~ (
/* Tomcat */
"org.apache.catalina.startup.Bootstrap", "-Dcatalina.base=*",
/* Jetty */
"org.eclipse.jetty.start.Main", "-Djetty.home=*",
/* WildFly / JBoss */
"org.jboss.modules.Main", "-Djboss.home.dir=*",
/* WebLogic */
"weblogic.Server", "-Dweblogic.Name=*", "*weblogic-launcher.jar*",
/* WebSphere traditional + Liberty */
"com.ibm.ws.runtime.WsServer", "com.ibm.ws.kernel.boot.cmdline.Bootstrap",
/* GlassFish */
"com.sun.enterprise.glassfish.bootstrap.ASMain",
/* Resin */
"com.caucho.server.resin.Resin",
/* Spring Boot */
"org.springframework.boot.loader.*",
/* Quarkus */
"*quarkus-run.jar*", "io.quarkus.runner.GeneratedMain",
/* Micronaut */
"io.micronaut.runtime.Micronaut",
/* Dropwizard */
"io.dropwizard.cli.ServerCommand",
/* Play */
"play.core.server.ProdServerStart",
/* Helidon */
"io.helidon.microprofile.server.Main", "io.helidon.webserver*",
/* Vert.x */
"io.vertx.core.Launcher",
/* Keycloak */
"org.keycloak*",
/* Apereo CAS */
"org.apereo.cas*",
/* Elasticsearch */
"org.elasticsearch.bootstrap.Elasticsearch",
/* Atlassian / Gerrit */
"com.atlassian.jira.startup.Launcher", "*BitbucketServerLauncher*", "com.google.gerrit.pgm.Daemon",
/* Solr */
"*-Dsolr.solr.home=*"
)
)
) and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox") and
process.args in ("-c", "-cl", "-lc") and
process.command_line like ("*wget *", "*curl *") and
(
process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}(:[0-9]{1,5})?/.*" or
process.command_line like ("*http*", "*ftp*")
) and
(
(
process.command_line regex~ """.*curl.* \-[a-zA-Z]*[oO]( .+|\-.*)?""" or
process.command_line like~ ("*curl* --output*", "*curl* --remote-name*")
) or
(
(
process.command_line regex~ """.*wget.* \-[a-zA-Z]*O.*""" or
process.command_line like~ "*wget* --output-document*"
) and
not process.command_line like """*--output-document "-"*"""
) or
process.command_line like ("*|*sh*", "*|*python*", "*|*php*", "*|*perl*", "*|*ruby*", "*|*node*", "*|*lua*", "*|*busybox*") or
(
process.command_line like ("*curl *>> /*", "*curl *>>/*", "*curl *> /*", "*curl *>/*", "*wget *>> /*", "*wget *>>/*", "*wget *> /*", "*wget *>/*") and
not process.command_line like ("*> /dev/null*", "*>/dev/null*", "*curl*/etc/cobra/*/uploads/whatsapp/*")
)
) and
not (
process.command_line like (
"*-O /dev/null*", "*-o /dev/null*", "*wget -qcO --user-agent=*", "*curl * | python -m json.tool",
"*http://:8008/dacx/fileoperation*", "*http://${host}:9000/api/system/liveness*"
) or
(process.parent.name == "ruby" and process.command_line like "*/tmp/passenger-native-support-*") or
(process.parent.name == "asterisk" and process.command_line like "*bapi.*.group/v2/call/outgoing*") or
(process.parent.name == "node" and process.command_line like "*/tmp/.claude/shell-snapshots/*") or
(process.parent.name == "apache2" and process.command_line like "*/var/www/html/cacti/dati/weathermap/*.jpg")
)
'''
min_endpoint_version = "8.2.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1190"
name = "Exploit Public-Facing Application"
reference = "https://attack.mitre.org/techniques/T1190/"
[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1505"
name = "Server Software Component"
reference = "https://attack.mitre.org/techniques/T1505/"
[[threat.technique.subtechnique]]
id = "T1505.003"
name = "Web Shell"
reference = "https://attack.mitre.org/techniques/T1505/003/"
[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1210"
name = "Exploitation of Remote Services"
reference = "https://attack.mitre.org/techniques/T1210/"
[threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "8.2.0"
behavior/rules/linux/persistence_payload_execution_by_node.js_web_server.toml
+184
View File
@@ -0,0 +1,184 @@
[rule]
description = """
This rule detects when a Node.js web server executes a payload. Attackers may exploit RCE or file upload vulnerabilities
to execute malicious payloads on Node.js web servers to gain/maintain access and to establish a command and control
channel.
"""
id = "b982a098-f3c6-42d7-958a-86c46f06360b"
license = "Elastic License v2"
name = "Payload Execution by Node.js Web Server"
os_list = ["linux"]
version = "1.0.1"
query = '''
process where event.type == "start" and event.action == "exec" and process.parent.interactive == false and
process.parent.name == "node" and process.parent.command_line like~ (
"*next start*", "*--port*", "*PORT=*", "*HOST=*", "*0.0.0.0*", "*/dist/*.js*", "*/build/*.js*", "*/server/*.js*",
"*/app/*.js*", "*/apps/*/*.js*", "*/index.js*", "*/main.js*", "*/srv/*", "*/opt/*", "*/var/www/*", "*n8n*"
) and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "mksh", "busybox") and
process.args in ("-c", "-cl", "-lc") and (
process.command_line like~ (
/* Suspicious Paths */
"* /tmp/* ", "* /var/tmp/* ", "* /dev/shm/*", "* /run/*", "* /var/run/*",
/* Encoding, Decoding & Piping */
"*|sh", "*| sh *", "*| sh ", "*|bash*", "*| bash*", "*|zsh*", "*| zsh*", "*|dash*", "*| dash*",
"*|python*", "*| python*", "*|php*", "*| php*", "*|perl*", "*| perl*", "*|ruby*", "*| ruby*",
"*|node*", "*| node*", "*|lua*", "*| lua*", "*|busybox*", "*| busybox*", "*|*base64 -d*", "*|*base64 --decode*",
"*|*base64 --decode*", "*|*openssl base64 -d*", "*xxd *", "*| openssl*enc * -d *", "*b64decode -r*",
/* Interpreter Execution */
"*python -c*", "*python3 -c*", "*php -r*", "*perl -e*", "*ruby -e*", "*lua -e*", "*node -e *",
/* Reverse Shells */
"*netcat *", "* nc *", "*ncat *", "*/dev/tcp*", "*/dev/udp/*", "*socat *", "*openssl*s_client *", "*stty*raw*-echo*",
"*mkfifo /tmp/*",
/* File Access */
"*>*/etc/cron*", "*crontab*", "*/etc/ssh*", "*/home/*/.ssh/*", "*/root/.ssh*", "*~/.ssh/*", "*/etc/shadow*",
"*/etc/passwd*", "*/etc/master.passwd*",
/* Enumeration & Discovery */
"*/etc/hosts*", "*/etc/resolv.conf*", "*/etc/hostname*", "*/etc/issue*", "*/etc/os-release*", "*lsb_release*",
"*/proc/*/environ*", "*sudo -l*", "*/proc/*/cgroup*", "*dockerenv*", "*/proc/*/mountinfo*", "*printenv*",
"*cat*.env *", "*getcap*", "*capsh*", "*find / *", "*netstat *",
/* AWS Credentials */
"*aws_access_key_id*", "*aws_secret_access_key*", "*aws_session_token*", "*accesskeyid*", "*secretaccesskey*",
"*.aws/credentials*", "*/.aws/config*",
/* Azure Credentials */
"*AZURE_CLIENT_ID*", "*AZURE_TENANT_ID*", "*AZURE_CLIENT_SECRET*", "*AZURE_FEDERATED_TOKEN_FILE*",
"*IDENTITY_ENDPOINT*", "*IDENTITY_HEADER*", "*MSI_ENDPOINT*", "*MSI_SECRET*", "*/.azure/*",
"*/run/secrets/azure/*",
/* GCP Credentials */
"*/.config/gcloud/*", "*application_default_credentials.json*", "*type: service_account*",
"*client_email*", "*private_key_id*", "*/run/secrets/google/*", "*GOOGLE_APPLICATION_CREDENTIALS*",
/* Misc. Cloud */
"*/.docker/config.json*", "*/.npmrc*", "*/secrets/kubernetes.io/serviceaccount/*",
/* Helpers */
"*timeout *sh -c *", "*env *sh *-c*", "*exec -a*",
/* Miscellaneous */
"*chattr *", "*busybox *", "*#!*", "*chmod +x *", "*chmod 777*", "*chpasswd*",
"*<?php*?>*", "*kworker*",
/* Decompression */
"*gzip -*d *", "*bzip2 -*d *", "*xz -*d *", "*tar -*x*",
/* Path Traversal */
"*../../../*etc/*", "*/.../*", "*../../../*home/*/*", "*../../../*root/*",
/* File Upload/Download */
"*pastebin.com*", "*transfer.sh*", "*bashupload.com*"
) or
process.args in ("id", "whoami", "hostname")
) and
not (
process.command_line like (
"sh -c node -v || nodejs -v", "*./postinstall*", "*./_postinstall*", "/bin/sh -c lsb_release -sd",
"*/etc/freepbx.conf*", "*betterme/image-processing-service-admin-frontend*"
) or
process.parent.args like (
"/opt/bitdefender/*", "/opt/cursor-agent/*", "/home/*/*", "/root/*", "/var/www/html/ext/.deloreanbuild",
"/usr/lib/node_modules/openclaw/dist/index.js", "/opt/yarn*", "*anthropic-ai/claude-code/cli.js*",
"/usr/bin/docker-builder", "/opt/jenkins/.nvm/versions/node/*/bin/npm", "/usr/local/renovate/node",
"/opt/buildagent/work/*/node_modules/.bin/cypress", "/var/www/html/ext/node_modules/.bin/webpack",
"/opt/containerbase/tools/node/*/bin/node", "/opt/*/bin/*/node_modules/.bin/bower"
) or
process.args like ("npx *", "node /var/www/html/ext/node_modules/.bin/webpack*", "grep* | awk*") or
process.parent.executable like (
"/user/*/.vscode-server/cli/servers/*/server/node", "/scratch/*/.vscode-server/cli/servers/*/server/node",
"/users/*/.vscode-server/*/node", "/opt/code-server/*/lib/node", "/opt/jenkins/workspace/*/bin/node",
"/scratch/user/*/.cursor-server/bin/linux-x64/*/node"
) or
process.working_directory == "/runner/_work/personify/personify/node_modules/snyk" or
(process.command_line like "*REPO_NAME*" and process.parent.args == "/usr/bin/n8n")
)
'''
min_endpoint_version = "8.2.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1190"
name = "Exploit Public-Facing Application"
reference = "https://attack.mitre.org/techniques/T1190/"
[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1505"
name = "Server Software Component"
reference = "https://attack.mitre.org/techniques/T1505/"
[[threat.technique.subtechnique]]
id = "T1505.003"
name = "Web Shell"
reference = "https://attack.mitre.org/techniques/T1505/003/"
[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1210"
name = "Exploitation of Remote Services"
reference = "https://attack.mitre.org/techniques/T1210/"
[threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "8.2.0"
behavior/rules/linux/persistence_setcap_setuid_setgid_capability_set.toml
+78
View File
@@ -0,0 +1,78 @@
[rule]
description = """
This rule monitors for the addition of the cap_setuid+ep or cap_setgid+ep capabilities via setcap. Setuid (Set User ID)
and setgid (Set Group ID) are Unix-like OS features that enable processes to run with elevated privileges, based on the
file owner or group. Threat actors can exploit these attributes to achieve persistence by creating malicious binaries,
allowing them to maintain control over a compromised system with elevated permissions.
"""
id = "c1556f07-4184-42dc-a55c-866011a63715"
license = "Elastic License v2"
name = "Setcap setuid/setgid Capability Set"
os_list = ["linux"]
version = "1.0.1"
query = '''
process where event.type == "start" and event.action == "exec" and
process.name == "setcap" and process.command_line like "*cap_set?id+ep*" and
not (
process.parent.name in ("jem", "vzctl") or
process.args like "/usr/bin/new?idmap"
)
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1548"
name = "Abuse Elevation Control Mechanism"
reference = "https://attack.mitre.org/techniques/T1548/"
[[threat.technique.subtechnique]]
id = "T1548.001"
name = "Setuid and Setgid"
reference = "https://attack.mitre.org/techniques/T1548/001/"
[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1548"
name = "Abuse Elevation Control Mechanism"
reference = "https://attack.mitre.org/techniques/T1548/"
[[threat.technique.subtechnique]]
id = "T1548.001"
name = "Setuid and Setgid"
reference = "https://attack.mitre.org/techniques/T1548/001/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/persistence_suspicious_echo_execution.toml
+15 -4
View File
@@ -9,7 +9,7 @@ id = "a13c8f01-36a5-4ad7-a282-8d297cf62860"
license = "Elastic License v2"
name = "Suspicious Echo Execution"
os_list = ["linux"]
version = "1.0.30"
version = "1.0.31"
query = '''
process where event.type == "start" and event.action == "exec" and
@@ -77,7 +77,15 @@ not (
"/home/*/*/codex/codex", "/home/*/.cache/JetBrains/*/codex-x86_64-unknown-linux-musl", "/home/*/.cursor-server/extensions/*/codex",
"/scratch/user/*/.vscode-server/extensions/openai.chatgpt-*-linux-x64/bin/linux-x86_64/codex", "/home/*/.aimee-code/bin/claude",
"/root/.opencode/bin/opencode", "/scratch/user/*/.nvm/versions/node/*/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe",
"/user/*/.vscode-server/extensions/openai.chatgpt-*/bin/linux-x86_64/codex", "/usr/local/bin/teleport", "/usr/bin/coreutils"
"/user/*/.vscode-server/extensions/openai.chatgpt-*/bin/linux-x86_64/codex", "/usr/local/bin/teleport", "/usr/bin/coreutils",
"/mnt/fast/nobackup/users/*/.local/share/code-server/extensions/*-linux-x64/resources/native-binary/claude",
"/home/linuxbrew/.linuxbrew/Caskroom/codex/*/codex-x86_64-unknown-linux-musl", "/usr/local/lib/claude-code/claude-bin",
"/home/*/.vscode/extensions/openai.chatgpt-*-linux-x64/bin/linux-x86_64/codex", "/home/*/.chipagents/chipagents/*/bin/chipagents-linux-x64",
"/home/*/.windsurf-server/extensions/anthropic.claude-code-*-linux-x64/resources/native-binary/claude",
"/home/*/.local/share/fnm/node-versions/*/installation/lib/node_modules/opencode-ai/bin/.opencode",
"/var/lib/docker/overlay2/*/merged/app/node_modules/@anthropic-ai/claude-agent-sdk-linux-x64/claude",
"/usr/local/share/npm-global/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe", "/home/*/.opencode/bin/opencode",
"/mnt/*/user/home/*/.local/share/claude/versions/*"
) or
process.parent.command_line in (
"runc init", "buildkit-runc init", "/usr/local/bin/runc init", "python ./ssh.py --update-fingerprints bi_team",
@@ -116,14 +124,17 @@ not (
"/nix/store/*", "/usr/bin/swatchdog*", "/usr/local/hostguard/data/benchmark/module/SSH/playbook.py",
"/tmp/kubectl*.yaml", "./mmicro-control.pl", "/usr/local/bin/vncserver", "buildah-chroot-exec", "/usr/libexec/crio/crun",
"/usr/bin/crun", "/usr/bin/vncserver", "/tmp/ansible_*/ansible_module_command.py", "/opt/calculus/farmer/app/farmer.py",
"openclaw-gateway", "lxc-attach", "/home/*/.npm-global/lib/node_modules/openclaw/dist/index.js", "/home/*/openclaw/openclaw.mjs"
"openclaw-gateway", "lxc-attach", "/home/*/.npm-global/lib/node_modules/openclaw/dist/index.js", "/home/*/openclaw/openclaw.mjs",
"/bin/segfaultsh"
) or
process.working_directory like ("/var/local/InterMapper_Settings/Tools", "/usr/local/gateway-*", "/repo/o11y/out/*/.terraform/*") or
(process.working_directory == "/etc/prometheus" and process.parent.command_line == "tmux -Lwarp -CC") or
(process.parent.name == "node" and process.command_line like~ ("*/tmp/claude*", "/usr/bin/bash -O extglob -c*")) or
(process.parent.name == "php" and process.command_line like "sh -c timeout 7200 ssh*") or
(process.parent.name == "node" and process.args == "extglob") or
(process.parent.name like "python*" and process.args like ("declare -A categories*", "files=*", "set -x*$BACKUP_NAME.tar.gz*", "*while_finding_grubconfigs*"))
(process.parent.name like "python*" and process.args like ("declare -A categories*", "files=*", "set -x*$BACKUP_NAME.tar.gz*", "*while_finding_grubconfigs*")) or
(process.parent.executable == "/usr/local/bin/php" and process.args like "timeout*/var/www/html/storage/app/ssh/mux/mux*") or
(process.parent.executable == "/usr/bin/perl" and process.command_line like "*/tmp/recover_SAP/settings*")
)
'''
behavior/rules/linux/persistence_suspicious_python_path_configuration_file_(.pth)_creation.toml
+78
View File
@@ -0,0 +1,78 @@
[rule]
description = """
Detects creation or change of a Python path configuration file (.pth) with a suspicious import preface, file size or
entropy. This rule matches .pth files whose leading bytes correspond to UTF-8 text beginning with an import-style
preface (for example, the string starting with "import os, subpr" as used before subprocess or similar calls). That
pattern is atypical and may indicate code execution via the .pth mechanism.
"""
id = "983dc90f-7eb0-4832-a537-3854b40d31fa"
license = "Elastic License v2"
name = "Suspicious Python Path Configuration File (.pth) Creation"
os_list = ["linux"]
reference = [
"https://dfir.ch/posts/publish_python_pth_extension/",
"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/",
"https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/",
"https://www.virustotal.com/gui/file/71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238",
]
version = "1.0.1"
query = '''
file where event.type in ("change", "creation") and file.extension like "pth" and (
file.Ext.header_bytes like "696d706f7274206f732c207375627072" or
(
file.path like "*site-packages*" and
(file.size >= 30000 or file.Ext.entropy >= 5.5)
)
)
'''
min_endpoint_version = "9.3.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"
[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[internal]
min_endpoint_version = "9.3.0"
behavior/rules/linux/privilege_escalation_potential_privilege_escalation_via_suid_sgid_proxy_execution.toml
+112
View File
@@ -0,0 +1,112 @@
[rule]
description = """
Detects potential privilege escalation via SUID/SGID proxy execution on Linux systems. Attackers may exploit binaries
with the SUID/SGID bit set to execute commands with elevated privileges. This rule identifies instances where a process
is executed with root privileges (user ID 0 or group ID 0) while the real user or group ID is non-root, indicating
potential misuse of SUID/SGID binaries.
"""
id = "86ef3949-5a1e-4e71-93a8-8e0ee90a71af"
license = "Elastic License v2"
name = "Potential Privilege Escalation via SUID/SGID Proxy Execution"
os_list = ["linux"]
reference = [
"https://dfir.ch/posts/today_i_learned_binfmt_misc/",
"https://gtfobins.github.io/#+suid",
"https://www.elastic.co/security-labs/primer-on-persistence-mechanisms",
]
version = "1.0.1"
query = '''
process where event.type == "start" and event.action == "exec" and
startswith~(process.command_line, process.executable) and process.parent.args_count == 1 and
(
(process.user.id == 0 and process.real_user.id != 0) or
(process.group.id == 0 and process.real_group.id != 0)
) and
process.args in (
"/bin/su", "/usr/bin/su",
"/bin/umount", "/usr/bin/umount",
"/bin/chfn", "/usr/bin/chfn",
"/bin/chsh", "/usr/bin/chsh",
"/bin/gpasswd", "/usr/bin/gpasswd",
"/bin/newgrp", "/usr/bin/newgrp",
"/usr/bin/newuidmap", "/usr/bin/newgidmap",
"/usr/lib/dbus-1.0/dbus-daemon-launch-helper", "/usr/libexec/dbus-daemon-launch-helper",
"/usr/lib/openssh/ssh-keysign", "/usr/libexec/openssh/ssh-keysign",
"/usr/bin/pkexec", "/usr/libexec/pkexec", "/usr/lib/polkit-1/pkexec",
"/usr/lib/snapd/snap-confine"
) and
process.args_count <= 2
/*
Need to exclude this in the future.
Leaving this in now because of the current CopyFail CVE-2026-24061, but it does not detect what this rule is supposed to detect.
and not process.name == "su" and process.args == "-"
*/
'''
min_endpoint_version = "8.6.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"
[[threat.technique]]
id = "T1548"
name = "Abuse Elevation Control Mechanism"
reference = "https://attack.mitre.org/techniques/T1548/"
[[threat.technique.subtechnique]]
id = "T1548.001"
name = "Setuid and Setgid"
reference = "https://attack.mitre.org/techniques/T1548/001/"
[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique]]
id = "T1548"
name = "Abuse Elevation Control Mechanism"
reference = "https://attack.mitre.org/techniques/T1548/"
[[threat.technique.subtechnique]]
id = "T1548.001"
name = "Setuid and Setgid"
reference = "https://attack.mitre.org/techniques/T1548/001/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "8.6.0"
behavior/rules/windows/collection_keystroke_capture_by_unsigned_process.toml
+2 -2
View File
@@ -12,14 +12,14 @@ reference = [
"https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-setwindowshookexa",
"https://www.elastic.co/security-labs/protecting-your-devices-from-information-theft-keylogger-protection",
]
version = "1.0.2"
version = "1.0.3"
query = '''
sequence by process.entity_id with maxspan=1m
[process where event.action == "start" and
process.Ext.relative_file_creation_time <= 300 and user.id != "S-1-5-18" and
(process.code_signature.trusted == false or process.code_signature.exists == false) and
not process.executable : ("?:\\Prgram Files\\*.exe", "?:\\Prgram Files (x86)\\*.exe")]
not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe")]
[api where process.Ext.api.name == "SetWindowsHookEx" and
process.Ext.api.parameters.hook_type == "WH_KEYBOARD_LL" and process.Ext.api.parameters.hook_module == "null" and
_arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == false or $entry.exists == false) and
behavior/rules/windows/defense_evasion_binary_masquerading_via_untrusted_path.toml
+6 -2
View File
@@ -12,7 +12,7 @@ reference = [
"https://www.elastic.co/security-labs/invisible-miners-unveiling-ghostengine",
"https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry",
]
version = "1.0.54"
version = "1.0.55"
query = '''
process where event.action == "start" and
@@ -129,7 +129,7 @@ process where event.action == "start" and
not (process.name : "services.exe" and process.args : "-i*" and process.parent.name : "monitor.exe") and
not (process.name : "RegAsm.exe" and process.args : ("directdeposit.vb.tlb", "?:\\Program Files (x86)\\*.dll", "?:\\Program Files\\*.dll")) and
not process.executable : "D:\\Reform V*\\Reform_PDC_Server_v*\\Plugins\\Monitoring\\CScript.exe" and
not (process.name : "rundll32.exe" and process.code_signature.subject_name in ("Teramind Inc.", "STAKHANOVETS LIMITED LIABILITY COMPANY") and process.code_signature.trusted == true) and
not (process.name : "rundll32.exe" and process.code_signature.subject_name : ("Teramind Inc.", "STAKHANOVETS LIMITED LIABILITY COMPANY") and process.code_signature.trusted == true) and
not (process.name : "regsvr32.exe" and
process.args : ("?:\\Sage\\Sage300 Programs\\GL69A\\FRCOM690.DLL",
"?:\\Program Files (x86)\\*.dll",
@@ -162,6 +162,10 @@ process where event.action == "start" and
not (process.executable : "C:\\ProgramData\\baramundi\\bma\\Downloads\\Temp\\netsh.exe" and
process.args : "exec" and process.args : "\\\\*.txt") and
not (process.name : "bcdedit.exe" and process.args : "/enum") and
not (process.executable : "?:\\Windows\\LFSAgent\\services.exe" and
process.code_signature.trusted == true and
process.code_signature.subject_name : "LEPIDE SOFTWARE PRIVATE LIMITED") and
not (process.name : "ping.exe" and process.executable : "?:\\Windows\\Temp\\pdk-SYSTEM-*\\ping.exe") and
not (process.code_signature.subject_name : ("JetBrains s.r.o.", "LG Electronics Inc.", "Timothy Hugh Perry", "Code Systems Corporation", "Douyin Vision Co., Ltd.", "Hangzhou Hikvision Digital Tech.Co.,Ltd") and process.code_signature.trusted == true) and
not process.hash.sha256 :
("7c621ec91b71d14494beddaae8edb67ed26baa257d750546772aa90653ad6016",
behavior/rules/windows/defense_evasion_suspicious_image_load_from_smb_shares.toml
+7 -12
View File
@@ -7,7 +7,7 @@ id = "c9674e88-8423-442a-9712-ba6271bcff10"
license = "Elastic License v2"
name = "Suspicious Image Load from SMB Shares"
os_list = ["windows"]
version = "1.0.22"
version = "1.0.23"
query = '''
sequence by process.entity_id with maxspan=1m
@@ -24,21 +24,16 @@ sequence by process.entity_id with maxspan=1m
process.executable != null and
(
(dll.name : ("ws2_32.dll", "wininet.dll", "psapi.dll") and
process.thread.Ext.call_stack_summary : "*kernelbase.dll|Unbacked*" and
not process.thread.Ext.call_stack_summary :
("*mscorlib.dll*","*|clr.dll*", "*coreclr.dll*", "*mscoreei.dll*", "*mscoree.dll*", "*system.ni.dll*",
"*mscorlib.ni.dll*", "*mscorwks.dll*", "*mscorsvc.dll*", "*system.private.corelib.dll*",
"*java.dll|Unbacked*", "*system.data.ni.dll*", "*|ntdll.dll|Unbacked|ntdll.dll", "*windowsbase.ni.dll*",
"*presentationframework.ni.dll*", "*system.windows.forms.ni.dll|Unbacked*")) or
process.thread.Ext.call_stack_summary == "ntdll.dll|kernelbase.dll|Unbacked") or
dll.name : ("dsquery.dll", "System.Management.Automation.dll")
) and
not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
not dll.hash.sha256 in ("fb26504a5d5a1b2045e526f873b84bbba57ea5715a16d2f48e26919abc273240",
"69f405cc2dd111d208799ad47273551e9d572423bcf251bc9347d481a162b207",
"550c6c449f101e9eebf00906ef04de5427f9e8dc27fef57bd03cb02f8cd3a0f7",
"aee47f2535e0196552513d37be8411a9b9c649a50c3d847488162580d8b88793") and
not (dll.name : "ws2_32.dll" and process.executable : "\\Device\\Mup\\*.edu\\*\\IDTest.exe") and
not (dll.name : "wininet.dll" and process.executable : "\\Device\\Mup\\nf01\\Application\\*.exe") and
not (process.name : "UiPath.ActivityCompiler.CommandLine.exe" and process.code_signature.subject_name : "UiPath, Inc." and
process.code_signature.trusted == true and dll.name : "System.Management.Automation.dll") and
not _arraysearch(process.thread.Ext.call_stack, $entry,
$entry.callsite_leading_bytes :
("ffeb1e8d4e0ce86482000083660400684c5*",
behavior/rules/windows/defense_evasion_suspicious_parent_child_relationship.toml
+6 -2
View File
@@ -12,7 +12,7 @@ reference = [
"https://www.elastic.co/security-labs/elastic-security-labs-discovers-lobshot-malware",
"https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit",
]
version = "1.0.43"
version = "1.0.44"
query = '''
process where event.action == "start" and
@@ -89,7 +89,11 @@ process where event.action == "start" and
process.parent.executable : ("?:\\Program Files (x86)\\Workplace\\Components\\WorkplaceContainerComponent\\Current\\Workplace Starter.exe",
"?:\\Program Files (x86)\\Workplace\\Components\\WorkplaceContainerComponent\\Current\\Workplace Container Helper.exe")) and
not (process.executable : "C:\\Windows\\Sys?????\\wbem\\WmiPrvSE.exe" and process.args : "/RegServer" and process.parent.name : ("powershell.exe", "cmd.exe")) and
not (process.parent.name == "lsass.exe" and process.args : "C:\\Program` Files\\PasswordRBL\\passwdfw.ps1")
not (process.parent.name == "lsass.exe" and process.args : "C:\\Program Files\\PasswordRBL\\passwdfw.ps1") and
not (process.name : "services.exe" and process.parent.executable : "?:\\Windows\\LFSAgent\\lasrv.exe" and
process.code_signature.trusted == true and
process.code_signature.subject_name : "LEPIDE SOFTWARE PRIVATE LIMITED") and
not (process.name : "LogonUI.exe" and process.parent.executable : "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\*\\FileCoAuth.exe")
'''
min_endpoint_version = "7.15.0"
behavior/rules/windows/initial_access_suspicious_virtualprotect_via_jscript9_from_internet_explorer.toml
+2 -2
View File
@@ -11,7 +11,7 @@ reference = [
"https://asec.ahnlab.com/en/83877/",
"https://medium.com/s2wblog/unmasking-cve-2024-38178-the-silent-threat-of-windows-scripting-engine-91ad954dbf83",
]
version = "1.0.4"
version = "1.0.5"
query = '''
api where process.Ext.api.name == "VirtualProtect" and
@@ -31,7 +31,7 @@ api where process.Ext.api.name == "VirtualProtect" and
process.Ext.api.metadata.target_address_path != "c:\\program files\\cerner\\ietools (64-bit)\\ietools.dll" and
not process.thread.Ext.call_stack_final_user_module.path like
("c:\\windows\\syswow64\\msvbvm??.dll",
"c:\\windows\\microsoft.net\\frameworkv*\\mscorwks.dll",
"c:\\windows\\microsoft.net\\framework\\v*\\mscorwks.dll",
"c:\\windows\\syswow64\\mfcore.dll") and
not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and
$entry.subject_name in (
behavior/rules/windows/persistence_suspicious_startup_persistence_via_a_windows_installer.toml
+5 -2
View File
@@ -7,7 +7,7 @@ id = "9f7aece1-355c-4e72-a7ea-767d5cccb12d"
license = "Elastic License v2"
name = "Suspicious Startup Persistence via a Windows Installer"
os_list = ["windows"]
version = "1.0.4"
version = "1.0.5"
query = '''
any where process.name : "msiexec.exe" and
@@ -20,7 +20,10 @@ any where process.name : "msiexec.exe" and
registry.data.strings : ("*C:\\Users*\\*\\Contacts\\*", "*cmd*/c*", "*powershell*", "*node.exe*.js*", "*rundll32*",
"*mshta.exe*", "*wscript.exe*", "*cscript.exe*", "*C:\\Users\\Public\\*") and
not registry.data.strings :
("rundll32.exe \"C:\\Program Files\\VMware\\VMware View\\Agent\\bin\\MessageFrameWork.dll\",EnvSyncW",
("rundll32.exe \"?:\\Program Files\\VMware\\VMware View\\Agent\\bin\\MessageFrameWork.dll\",EnvSyncW",
"rundll32.exe ?:\\PROGRA~1\\Omnissa\\Horizon\\Agent\\bin\\MESSAG~1.DLL,EnvSyncW",
"rundll32.exe \"?:\\Program Files\\Omnissa\\Horizon\\Agent\\bin\\MessageFrameWork.dll\",EnvSyncW",
"rundll32.exe DR*Svc.dll,EntryPointUserMessage",
"rundll32.exe DR*SVC.dll, EntryPointUserMessage",
"rundll32.exe P*Svc.dll, EntryPointUserMessage",
"rundll32.exe DRV*.dll,EntryPointUserMessage",