mirror of
https://github.com/elastic/protections-artifacts
synced 2026-06-08 14:02:19 +00:00
protectionsmachine
66 lines
2.3 KiB
TOML
66 lines
2.3 KiB
TOML
[rule]
|
|
description = """
|
|
Detects the execution of Powershell (pwsh) with the encoded command flag set in the process arguments, in conjunction
|
|
with an unusual process command line length. Powershell usage on Linux is rare, and the usage of encoded commands with
|
|
unusual lengths is through Powershell may indicate malicious behavior.
|
|
"""
|
|
id = "cd6e64ec-2890-4bd8-9d07-bef06465b06f"
|
|
license = "Elastic License v2"
|
|
name = "Linux Powershell Encoded Command"
|
|
os_list = ["linux"]
|
|
version = "1.0.15"
|
|
|
|
query = '''
|
|
process where event.action == "exec" and event.type == "start" and process.name == "pwsh" and
|
|
process.args : ("-EncodedCommand", "-enc", "-E") and process.args : ("-nop", "-noprofile") and
|
|
length(process.command_line) >= 100 and not (
|
|
process.parent.name in ("node", "code", "code-insiders", "cursor") or
|
|
process.parent.command_line : "*Invoke-Pester*" or
|
|
process.parent.args == "--utility-sub-type=node.mojom.NodeService" or
|
|
process.parent.executable like ("/data/user/docker/*", "/tmp/.mount_Cursor*/usr/share/cursor/cursor") or
|
|
process.parent.executable in ("/usr/lib/electron30/electron", "/usr/lib/electron32/electron", "/tmp/newroot/proc/self/exe") or
|
|
(
|
|
process.args == "IAAoAEcAZQB0AC0ASABvAHMAdAApAC4AVgBlAHIAcwBpAG8AbgAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAA=" and
|
|
process.parent.args == "Invoke-LightRail.ps1"
|
|
) or
|
|
process.args like~ "JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAdABvAHAAJwAKAFsAdgBlAHIAcwBp*" or
|
|
process.args in (
|
|
"VwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAEgARQBMAEwATwAgAFcATwBSAEwARAAnAA==", "dwByAGkAdABlAC0AaABvAHMAdAAgACIAdABlAHMAdAAiAA=",
|
|
"dwByAGkAdABlAC0AaABvAHMAdAAgACIAdABlAHMAdAAiAA=="
|
|
)
|
|
)
|
|
'''
|
|
|
|
min_endpoint_version = "7.15.0"
|
|
optional_actions = []
|
|
[[actions]]
|
|
action = "kill_process"
|
|
field = "process.entity_id"
|
|
state = 0
|
|
|
|
[[actions]]
|
|
action = "kill_process"
|
|
field = "process.parent.entity_id"
|
|
state = 0
|
|
|
|
[[threat]]
|
|
framework = "MITRE ATT&CK"
|
|
[[threat.technique]]
|
|
id = "T1059"
|
|
name = "Command and Scripting Interpreter"
|
|
reference = "https://attack.mitre.org/techniques/T1059/"
|
|
[[threat.technique.subtechnique]]
|
|
id = "T1059.001"
|
|
name = "PowerShell"
|
|
reference = "https://attack.mitre.org/techniques/T1059/001/"
|
|
|
|
|
|
|
|
[threat.tactic]
|
|
id = "TA0002"
|
|
name = "Execution"
|
|
reference = "https://attack.mitre.org/tactics/TA0002/"
|
|
|
|
[internal]
|
|
min_endpoint_version = "7.15.0"
|