mirror of
https://github.com/elastic/protections-artifacts
synced 2026-06-08 14:02:19 +00:00
protectionsmachine
58 lines
2.0 KiB
TOML
58 lines
2.0 KiB
TOML
[rule]
|
|
description = """
|
|
This rule monitors for suspicious Ruby command executions by detecting the start of a Ruby process with a command line
|
|
argument that contains keywords commonly used by attackers to execute malicious code. These command line arguments
|
|
include operations to execute code, create subprocesses, and encode or decode data.
|
|
"""
|
|
id = "a3a3b49c-c135-4959-8a1b-33392bb60991"
|
|
license = "Elastic License v2"
|
|
name = "Suspicious Ruby Command Execution"
|
|
os_list = ["linux"]
|
|
version = "1.0.8"
|
|
|
|
query = '''
|
|
process where event.type == "start" and event.action == "exec" and process.parent.executable != null and
|
|
process.executable like~ ("/bin/ruby*", "/usr/bin/ruby*", "/usr/local/bin/ruby*") and
|
|
process.args like "-e*" and process.command_line like~ (
|
|
"*system(*", "*exec(*", "*IO.popen(*", "*Open3.popen3(*", "*spawn(*", "*eval(*", "*load(*",
|
|
"*Marshal.load(*", "*Fiddle.dlopen(*", "*Fiddle::Function.new(*", "*base64*", "*zlib*",
|
|
"*net/http*", "*socket*", "*open-uri*", "*pack(*", "*unpack(*"
|
|
) and
|
|
not (
|
|
process.working_directory like~ ("/etc/puppet/rack", "/builds/*", "/var/tmp/portage/*") or
|
|
process.command_line like ("*rails_env*", "*pid*Process.spawn*ssh*StrictHostKeyChecking*ServerAliveInterval*ServerAliveCountMax*") or
|
|
process.parent.command_line in ("emacs --daemon", "runc init") or
|
|
process.parent.name in ("emacs-gtk", "mmonit", "make") or
|
|
(process.name == "ruby" and process.parent.name == "ruby") or
|
|
process.parent.executable == "/opt/gitlab/embedded/bin/gitaly"
|
|
)
|
|
'''
|
|
|
|
min_endpoint_version = "7.15.0"
|
|
optional_actions = []
|
|
[[actions]]
|
|
action = "kill_process"
|
|
field = "process.entity_id"
|
|
state = 0
|
|
|
|
[[actions]]
|
|
action = "kill_process"
|
|
field = "process.parent.entity_id"
|
|
state = 0
|
|
|
|
[[threat]]
|
|
framework = "MITRE ATT&CK"
|
|
[[threat.technique]]
|
|
id = "T1059"
|
|
name = "Command and Scripting Interpreter"
|
|
reference = "https://attack.mitre.org/techniques/T1059/"
|
|
|
|
|
|
[threat.tactic]
|
|
id = "TA0002"
|
|
name = "Execution"
|
|
reference = "https://attack.mitre.org/tactics/TA0002/"
|
|
|
|
[internal]
|
|
min_endpoint_version = "7.15.0"
|